Recognize the redirect pattern
A redirect seen only by some visitors may be conditional on the referrer, device, logged-in status or user agent. It may also be a legitimate configuration or caching fault, so do not assume every redirect proves a hack.
- Record the affected URL, destination URL and first time observed.
- Check whether the problem appears when logged out and from another browser or network.
- Take screenshots and preserve available hosting or application logs before experimenting.
Do not repeatedly follow suspicious destinations on a sensitive device.
What to investigate
On a controlled and authorized installation, common investigation surfaces include:
- Redirect rules and rewrite configuration at the web-server or application layer.
- Core, plugin and theme file integrity and recently modified scripts.
- Database-stored URLs, injected content, suspicious accounts and scheduled tasks.
- Any application or host-level cache or CDN rules masking current behavior.
Removing one redirect rule is not sufficient evidence that the source of a compromise has been removed.
After the visible redirect disappears
Verify legitimate page behavior, access controls and available security logs, and review any browser or search warning removal procedure if appropriate.
- Test representative pages without cached admin sessions.
- Review likely entry vectors and update supported components.
- Assess whether search results have indexed spam URLs or need remediation.
Do not promise blacklist removal within a fixed time; external providers control reviews.
Relevant official documentation
These references inform the general guidance. They do not verify any individual site's condition.
Need someone to investigate?
You can describe the symptoms without identifying the cause yourself. Credentials are not requested in the public form.
Request a repair ↗