Why Is My WordPress Site Redirecting to Spam?

Why is my WordPress site redirecting to spam websites?

Almost always because malicious code was added to your site. Hackers insert a small script or edit a file so that some visitors are sent to scam, gambling or fake-update pages. It is rarely a glitch. Treat it as a hack until a check proves otherwise.

The cause is usually an outdated plugin or theme, a stolen password, or an unpatched server. The GoDaddy annual cybersecurity report found malicious redirects on 21.7 percent of the 834,661 infected sites it recorded in 2025.

Why does my site redirect only on mobile or only from Google?

Attackers often hide the redirect from the site owner. Code can check whether a visitor came from a search result, uses a phone, is logged out, or is visiting for the first time. If you are logged in as an admin or type the address directly, you may see nothing wrong.

This is why "it works for me" is not a clean bill of health. Test in a private browser window on a phone using mobile data, and search for your business name in Google, then click your result. Ask a colleague or customer to do the same, and ask them to send a screenshot.

What are the common signs of a redirect hack?

Besides redirects, look for related symptoms. They help you decide how deep the problem goes and what to tell a professional. None of them alone proves a hack, but two or three together make it very likely. Write down what you see on each one so a professional can start faster.

• • Visitors report landing on gambling, adult, pharmacy or "your browser is out of date" pages
• • Google results show odd titles or foreign-language text for your pages
• • You cannot log in, or there are admin users you do not recognize
• • Your host sent a malware or abuse warning
• • The site is slow, or files changed on dates you did not touch them
• • Browsers show a security warning when opening the site

What kinds of redirect malware are active now?

Two kinds dominate. One is SEO spam, where junk pages and redirects are planted to sell something or steal search traffic. In 2025, GoDaddy and Sucuri found SEO spam on 328,490 sites, with gambling spam (126,312 sites) overtaking Japanese keyword spam (89,646 sites) for the first time in over 10 years.

The other is fake-update malware, where visitors see a "browser update" or fake CAPTCHA prompt. The same report counted this social-engineering malware on 74,750 sites in 2025. In June 2026, an international police action cleaned 14,971 WordPress sites used for a fake-update network called SocGholish, per Security Affairs.

Can I fix the redirect myself?

You can try the basics, but redirect malware is built to come back. Update WordPress, plugins and themes, remove plugins you do not use, change all passwords, and scan the site. Be careful about editing files by hand if you are not sure what you are looking at.

The common trouble spots are listed here, so you know what a person will check.

If a fix "worked" and the redirect returns in a day or two, a backdoor is almost certainly left behind. Read why sites get hacked again after cleanup.

What do I do right now to protect visitors?

Contain it first. Put up a maintenance page if you can. Back up the infected site for evidence, change your hosting and admin passwords, and tell your host. Do not restore an old backup blindly, since it may carry the same weakness.

Our first-hour checklist for a hacked WordPress site walks through each step in order. After that, a cleanup removes the malware and the way back in. Pricing for professional cleanups is in what WordPress malware removal costs.

Could my server's PHP version be the cause?

Sometimes. In October 2026, two serious flaws in PHP, nicknamed PHP2Shell, were announced, and CISA added them to its list of flaws used in real attacks on October 26 (CISA alert). An old PHP version makes any break-in easier. Ask your host which PHP version your site runs before you blame the plugins.

We cannot say whether a given redirect came through that route without looking at the site. Check your version with our free PHP version checker. If you are on PHP 8.1 or older, read PHP2Shell and WordPress owners.

How does Cuanto Labs clean a redirect infection?

We take a copy of the site, find the injected code in files and the database, remove backdoors, audit admin users, reset the security keys and test the site on desktop and mobile. You get a clean report. Our Emergency Cleanup is $495 for one site.

It starts within 4 business hours, and most jobs finish in 24 to 48 hours, with a free re-clean for 30 days. If you want the cause found and fixed too, Cleanup + Hardening is $895 and includes updates and a firewall and two-factor setup. See the WordPress security service.

Next step

If your site is redirecting now, do not wait for the next customer to report it. Book a call and tell us what you see. We will say plainly whether it is a hack and what a fix involves.

This article is general information, not legal or compliance advice. Written by Eliran Yihye, founder of Cuanto Labs, on October 27, 2026.