Hacked site

Your site redirects to spam, but only from Google or on mobile

You type your web address and the site loads normally. You can log in to WordPress without trouble. But a customer says that when they click your site in Google, they end up on a pharmacy or gambling page. Or it only happens on their phone.

The WordPress.org support forums have many threads like this. Owners say the site "displays well" when they visit it directly, while other people keep seeing the spam page. Volunteers there often reply that they can't reproduce the redirect, which is how this kind of malware is meant to behave.

Run a free scan Talk to us
01Why it only happens sometimes
02How to reproduce it
03Where the code usually hides
Scroll ↓

01

Why it only happens sometimes

This is a conditional redirect. The malicious code checks who's visiting before it does anything. Common checks:

  • Referrer: only redirect visitors arriving from Google, Bing or social media

  • Device: only redirect mobile browsers

  • Logged-in status: never redirect WordPress admins, so the owner doesn't notice

  • Repeat visits: redirect once, then set a cookie and leave that visitor alone

  • IP address: skip known security scanners and the owner's own IP

So the owner, who types the address on a desktop while logged in, is the one person least likely to see it.

02

How to reproduce it

  1. Log out of WordPress, or use a private window.

  2. Search for your site on Google from a phone on mobile data, not your office Wi-Fi, and tap the result.

  3. Try a different browser and clear cookies between tries.

  4. Use a command-line request with a Google referrer and a mobile user agent, for example curl -I -e "https://www.google.com/" -A "Mozilla/5.0 (iPhone)" https://yoursite.com/, and look for a 301 or 302 to a domain you don't know.

  5. Search Google for site:yoursite.com and check for pages in Japanese or pages about products you don't sell. That's often the same infection.

03

Where the code usually hides

  • .htaccess: rewrite rules that check HTTP_REFERER or HTTP_USER_AGENT. The forum advice to back up and remove .htaccess comes from this.

  • wp-config.php or index.php: a few lines of obfuscated PHP added at the top.

  • The theme's functions.php or header.php.

  • A fake plugin or a file in /wp-content/uploads/ that shouldn't be PHP.

  • The database: JavaScript injected into posts, widgets or the wp_options table, which loads an off-site script that does the redirect in the browser.

  • Must-use plugins in /wp-content/mu-plugins/, which don't show in the normal plugin list.

Check file modification dates over FTP too. Files changed on a day nobody worked on the site are a lead.

04

Cleaning it properly

Deleting the redirect isn't enough. It got there through something, usually an outdated plugin or theme, a stolen password or a leftover admin account. If that stays open, the redirect comes back. A proper cleanup removes the code, finds and closes the entry point, removes any backdoors, changes all passwords and asks Google to review the site if it was flagged.

Related

Free scan

Start with a free scan

A free CrawlCare scan checks your site from the outside, including outdated plugins and known malware signs. If it finds a problem, or the redirect is still happening and you can't find it, have a chat with us.

Talk to us