Why Is My Website Redirecting to Another Site? How to Stop Hacked Redirects and Spam Ads

If your website is redirecting to another site — a spam ad, a sketchy "you've won a prize" page, an adult site, or a fake pharmacy — your website has been hacked. There's no gentler way to say it. A website redirecting to spam is one of the most common symptoms of a compromised site we see at DS Web Solutions, and it almost always means an attacker has injected a malicious script that hijacks your visitors the moment they land. The good news: it's fixable, usually the same day. The bad news: deleting the one script you can find rarely stops it, because the redirect is only the visible tip of the infection.

What a hacked redirect actually is

A hacked redirect is a piece of malicious code — usually JavaScript — that an attacker has slipped into your site's files or database. When a visitor loads your page, that code fires and sends their browser to a destination the attacker controls, typically an ad network that pays the attacker per redirected visitor. Google's own documentation on hacked content describes exactly this pattern: injected code that "redirects some users to harmful or spammy pages." Your real content may still be sitting there underneath — but nobody ever sees it, because the redirect fires first.

Why it often only happens to some visitors

One of the most maddening parts of a hacked redirect is that it can seem to come and go. You visit your own site and it looks fine; a customer visits and gets thrown onto a spam page. That's deliberate. Modern redirect malware is conditional — it checks who's visiting before it fires. The most common tricks:

• Mobile-only redirects — the script fires for phone visitors but not desktop, so the owner (usually on desktop) never sees it while mobile customers get hijacked.
• Referrer-based redirects — it fires only when someone arrives from a Google search result, so typing your URL directly looks clean but your actual search traffic gets stolen.
• First-visit-only redirects — it drops a cookie and fires once, so on your second look everything seems normal.
• Logged-out-only redirects — it skips anyone logged into WordPress, meaning the admin almost never triggers it.

If your site looks fine to you but customers say it sends them to spam, believe the customers. The malware is hiding from you on purpose.

How to confirm it's a hacked redirect

Before assuming the worst, confirm it. Open your site in an incognito window on your phone, and again by clicking through from a Google search result rather than typing the address. Check Google Search Console's Security Issues report — Google flags detected malware and "redirects" there. Run your URL through Google Safe Browsing's site status check and a free external scanner like Sucuri SiteCheck, which loads your page the way a stranger's browser would and reports injected scripts. If any of those show a redirect or malicious code, it's confirmed — and you'll want professional malware cleanup rather than a guessing game with your live site.

Why deleting the redirect script doesn't fix it

Here's the trap almost every DIY cleanup falls into. You find the suspicious script, delete it, and the redirect stops — for a few hours or a few days. Then it's back. That's because the redirect is the payload, not the entry point. Attackers scatter backdoors — hidden re-infection scripts disguised as ordinary files — throughout the site, so that removing the visible malware just triggers them to reinstall it. And the original hole that let them in, almost always an outdated plugin or theme, is still wide open for the next automated attack to walk through. A cleanup that doesn't hunt every backdoor and close the root cause is a cleanup that reinfects. Our guide to how WordPress sites get hacked explains exactly how that entry point works and why it's so often a neglected plugin.

Getting your site clean and keeping it clean

A proper fix follows one order: take a forensic backup, map the full infection across files and database, remove the redirect and every backdoor, close the vulnerability that caused it, and rotate every credential so the attacker can't simply log back in. If Google has already flagged your site, the last step is filing for review so the warnings come down — which we cover in how to remove Google's "this site may be hacked" warning. This is exactly what our Code Red service does: emergency website malware removal with same-day response, a flat price quoted upfront, and the site returned clean, patched, and hardened against the next attack. If your site is redirecting customers to spam right now, don't fight it file-by-file on a live site — call us or use the contact form on our homepage and we'll stop the bleeding today.