Remove redirect malware from WordPress

A WordPress redirect hack often leaves wp-admin looking normal. Visitors, or only Google, get sent to another domain. If you can open the homepage and Search Console still shows spam URLs, the response is different for Google than it is for you. That is cloaking, and a scanner that only fetches the page as a browser will report the site clean.

Look in this order:

1. .htaccess in the site root and in wp-content. Rules that check the user agent or the query string are the ones that bounce Google and let you through.
2. wp-content/mu-plugins/. Anything in that folder runs on every request and does not show under Plugins.
3. PHP files in wp-content/uploads/, and a recently edited header.php or functions.php you did not change.
4. The siteurl and home rows, plus any widget or option that suddenly contains a script. One leftover loader brings the redirect back after you delete the obvious file.

Write down the URL you started on and where it landed. Check once in a private window and once from a phone. Desktop-only testing misses the mobile rule.

CypherSecurity removes WordPress redirect malware as part of emergency cleanup: locate injection and cloaking mechanisms, remove unauthorized code and persistence, check integrity of themes/plugins/core, and verify that key entry URLs no longer bounce visitors or bots to attacker destinations.

If Safe Browsing flagged you because of those redirects, cleanup enables the review path afterward — see Google Safe Browsing removal. Work starts after 50% deposit and intake; master’s-level cybersecurity practice via MDI LABS.

Redirect cleanup is usually emergency-tier work because active visitor harm is happening now. Light blacklist packages are for quieter flagging cases. If you are unsure, pay for emergency or book triage; we would rather start on the right tier than leave redirects live.

We reproduce or document the redirect behavior when possible, inspect common WordPress load points (.htaccess, themes, mu-plugins, uploads PHP, database options), remove the chain, and verify. Handoff covers password rotation and update posture so the same plugin or credential hole is less likely to reload the malware.

Primary CTA is emergency deposit; compare all options at #packages. Continuity ($149–$299/mo) is recommended after redirect cleanups because these infections often return when monitoring is absent — still optional, with easy opt-out.

After redirects are gone, rotate passwords, drop unused plugins, and watch for recurrence for a few weeks. Continuity is recommended for that watch window; skip it if your developer already monitors the site daily.