WordPress Redirect Malware
Why the site looks fine to you and redirects everyone else — and where the code hides.
Redirect malware is the most commonly reported WordPress infection, and the most confusing, because it is written specifically so the owner does not see it.
Why you cannot reproduce it
The injected code checks conditions before firing: is the visitor logged in, what is the user agent, did they arrive from a search engine, have they been redirected already this session? Administrators fail every one of those checks. Your customers pass them.
How to see it
- Use a private window, logged out, on mobile, arriving from a search result rather than typing the URL.
- Set a mobile user agent in your browser dev tools.
- Fetch the page with a search-engine referrer and compare the HTML to what you normally get.
- Use an external fetch tool so nothing on your machine is cached.
Where the code lives
wp_options—siteurlandhomealtered, or injected script in an option value.- Theme files, most often
header.php,footer.phpandfunctions.php. .htaccess— conditional rewrite rules based on user agent or referrer.- A small PHP file in
uploads, included from somewhere legitimate-looking. - A plugin that appears real but is not in the directory, or a directory with an innocuous name and one file.
wp-includes— core file modifications, which a core comparison catches immediately.
Cleaning the visible injection without finding the entry point is the reason this infection is famous for coming back. The code is usually reinstalled by something still on the server.
Full process: how to clean an infected WordPress website.
Hardening reduces the damage. Patching removes the hole. Scan your site free to see what still needs patching.
