If your WordPress site sends visitors to a spam, gambling or pharmacy site, it has been hacked. Here's what's going on, what to check, and how it gets fixed.
What it means
Visitors type your domain and end up on a completely different site - usually spam, gambling, pharma, or counterfeit goods. Your site has been compromised with malicious redirect code.
Why it happens
Hackers inject redirect scripts into your theme files, wp-config.php, .htaccess, or database. They profit from your traffic by sending it to their sites. Sometimes redirects only trigger for search engine visitors or specific user agents.
A real example
Visitors typing the business URL ended up on a random casino or pharma site, while the owner's own browser showed the correct page. That split behavior is the signature of a conditional redirect injection - malware that checks the visitor's referrer, user agent, or geography and sends everyone except the site owner to the spam destination. The redirect code is usually hidden in wp-config.php, the theme's functions file, or a rogue must-use plugin, which is why a surface-level "scan" often misses it entirely.
What to do
- Check if the redirect happens for everyone or just some visitors (try incognito, different devices).
- Scan core files - check wp-config.php, .htaccess, and theme files for injected code.
- Check the database for malicious entries in wp_options (siteurl, home) or injected scripts.
- Look for recently modified files - the hack usually touches files with recent timestamps.
- Change all passwords immediately - admin, database, FTP, hosting.
Still stuck? Malicious redirects mean an active compromise - we contain it, remove the injected code, and harden the site against reinfection.
Get emergency help