Website Redirect Hack Removal

People contact us with the same handful of stories. A customer phones to say the site “took them to a betting page”. Google Search Console flags “Deceptive site ahead” or the browser paints a red interstitial. Analytics shows a cliff in mobile conversions with no change to desktop. Sometimes the only clue is a staff member’s own phone opening a different site than their laptop does on the same URL.

Injected redirect code reads the request before it decides what to do. It checks the user agent for a mobile signature, looks at the HTTP referer for a search engine, and often sets a cookie so the same person is only redirected once. If you keep refreshing from your own machine you will conclude the site is fine. That is why owners lose days before they accept there is a real problem.

Cleaning files and leaving the database is the classic reason a redirect returns within hours. We search the full database, not just wp_options, for encoded strings, script tags in post content, and injected rows in the users table. A single overlooked entry in the active theme’s options can rebuild the entire attack.

Multisite and shared hosting cases

On a multisite network or a reseller account with several sites in one hosting space, a redirect can jump between neighbours through a shared uploads directory or a common cron. We check every site that shares the account, because signing off on one while its neighbour is still infected buys you a reinfection by the weekend.

We download a pristine copy of your CMS core and the exact plugin and theme versions you run, then diff your files against them. Anything that differs from the vendor original is a candidate. This surfaces the two extra lines dropped into an otherwise legitimate file, which is where redirects love to hide.

Alongside the diff we grep the codebase for the tell-tale constructs: eval, base64_decode, gzinflate, str_rot13, long hexadecimal blobs and document.location rewrites. Every hit is read by a person before anything is deleted, so a legitimate caching plugin that happens to use base64 is never mistaken for malware.

Removing the redirect is not the finish line. We pull your web server access logs and correlate the file modification timestamps with the requests around them. That usually pins the exact vulnerable plugin, upload endpoint or stolen login that let the attacker in, which is the information you need to make sure this does not happen again.

Clean removal without breaking the site

Because we identify precisely which bytes are malicious, we remove the injection rather than deleting whole files and hoping. Your layout, your content and your working plugins stay intact. Where a core or plugin file has been tampered with, we replace it with the clean vendor version so nothing you rely on stops working.

After the site is verified clean we help you file the security-issue review in Search Console and, where a browser warning is present, the Safe Browsing review. We make sure the request is submitted only when the site is genuinely clear, because a rejected review resets the clock and can leave you flagged for longer.

Some hosting providers suspend an infected account, and third-party blocklists such as those used by antivirus vendors can also mark you. We provide the clean-up evidence you need to get an account reinstated and to request delisting from the major blocklists.

If the logs point to an out-of-date plugin, we update or replace it and remove any abandoned plugins that are no longer maintained. If a login was brute-forced, we reset credentials and enforce two-factor authentication on administrator accounts.

We tighten file permissions, disable the in-dashboard file editor, lock down the uploads directory so it cannot execute PHP, and remove the fake admin users and rogue cron jobs the attacker left as a way back in. On request we set a web application firewall in front of the site to block the injection attempts before they land.

Optional ongoing protection

For sites that were compromised once through a known-weak stack, we offer a low-cost monthly monitoring option that watches file integrity and alerts on new admin users, so a repeat attempt is caught in hours rather than after your customers notice.

You receive a short written summary: what was infected, where the redirect lived, the entry point we found in the logs, what we removed, and the hardening we applied. That record is what your host, your insurer or your compliance officer will ask for, and it is what tells you the job was done properly rather than papered over.