A WordPress redirect hack is a specific attack where malicious code silently redirects your visitors — and Googlebot — to spam sites, while injecting fake URLs into your sitemap. Google deindexes your pages, your organic traffic collapses, and your rankings can take months to recover. This isn't general malware; it's a targeted SEO assassination.
What Does a WordPress Redirect Hack Actually Look Like?
Your site appears to load fine on your laptop. Your homepage looks normal. But when a visitor arrives from Google — or when Googlebot crawls a product page — they get sent somewhere else entirely. A pharma spam site. A fake download page. An adult content hub. The redirect is conditional: it only fires for search engine traffic or first-time visitors, specifically so you won't notice it during normal browsing.
Alongside the redirect injection, attackers typically:
- Add hundreds of spam URLs to your XML sitemap (or create a new one at
/sitemap_spam.xml) - Create fake pages stuffed with hidden keyword links (pharmaceutical, gambling, adult)
- Inject backlinks in your footer that point to their target domains
- Modify your
robots.txtto allow their injected pages to be indexed
The business result is predictable and brutal. According to Semrush's 2025 Site Health Report, sites hit by redirect hacks see an average organic traffic drop of 68% within six weeks of infection. If you're running an ecommerce store or a lead-gen site, that's not an abstract SEO problem — it's a revenue emergency.
How to Know If Your WordPress Site Has Been Redirect-Hacked
Check Google Search Console first. This is almost always where the evidence surfaces before you notice the traffic drop.
Signs to look for in GSC:
- Manual Action notice — especially "Spammy free host," "User-generated spam," or "Unnatural links to your site"
- Coverage errors showing URLs you didn't create being submitted for indexing
- Sitemap errors for sitemaps you never added
- Security Issues tab showing "Deceptive pages" or "Harmful downloads"
Also run a search on Google: site:yourdomain.com. If you see results for pages like /cheap-viagra-online/ or /casino-bonus-codes/, the injection is already in Google's index and you're likely already being penalized.
Check your redirect behavior as an outside visitor. Use a tool like curl -A "Googlebot" -L https://yourdomain.com in your terminal, or use a crawler emulator. If the response is a 301 to a spam domain, you've confirmed the attack.
Look at your server access logs. Redirect hacks almost always leave a pattern: bursts of 301 responses to the same destination domain, often targeting traffic with referrer headers from google.com or bing.com.
Where Hackers Hide the Redirect Code
This is where most DIY cleanup attempts fail. People reinstall WordPress, switch themes, and deactivate plugins — then the redirect comes back within a week. Here's why: the injection points are rarely in the obvious places.
| Location | What to Look For |
|---|---|
.htaccess (root and subdirectories) | RewriteCond rules targeting Googlebot or referrer headers |
wp-config.php | Encoded eval(base64_decode(...)) blocks near the top |
Database — wp_options | Malicious values in siteurl, home, or injected serialized objects |
Database — wp_posts | Hidden iframe or redirect code inside post content |
| Rogue PHP files | Files named wp-content.php, class-wp-cache.php, or similar |
Theme functions.php | Conditional redirect functions added below legitimate code |
wp-includes | Modified core files with added redirect logic |
The reason plugin-layer scanners miss most of these is architectural: they run inside WordPress, after WordPress has already bootstrapped. If the malicious code modified the WordPress bootstrap itself — or lives outside the webroot — the scanner never sees it. We covered this limitation in detail in our guide to how Wordfence removes malware.
Step-by-Step: Recovering From a WordPress Redirect Hack
1. Take the Site Offline or Put It in Maintenance Mode
Before you clean anything, stop the bleeding. If Googlebot keeps crawling spam redirects, you're digging a deeper ranking hole. Put the site in maintenance mode or — better — restrict it to your IP while you work.
2. Pull a Clean Backup (Even the Infected One)
You need a reference point. If you're on managed hosting, check whether you have daily backups you can diff against. If you're on shared hosting, pull what you have. Our WordPress backup strategy guide covers what a solid backup setup looks like — spoiler: most shared hosting "backups" are not actually recoverable.
3. Do a Full Server-Side Scan
This is the step that separates a real cleanup from a temporary fix. You need to scan the filesystem and database at the server level, not from inside WordPress. Look for:
- Files modified in the last 30-60 days that shouldn't have been
- Files with
eval,base64_decode,gzinflate, orstr_rot13patterns - Database entries with encoded content in option values or post content
Run find /var/www/yourdomain -name "*.php" -newer /var/www/yourdomain/wp-login.php as a starting point for recently modified PHP files. Cross-reference against a clean WordPress install of the same version.
4. Clean the Injection Points (All of Them)
Replace every modified file with a clean copy. Restore wp-config.php, .htaccess, and all core files from official WordPress sources. Clean the database — especially wp_options — manually if needed. Remove every spam URL from your sitemap and delete any rogue sitemap files.
Do not just reinstall WordPress over the infected installation. That doesn't touch the database, doesn't touch modified plugin files, and doesn't remove rogue PHP files outside the WordPress directory.
5. Find and Fix the Entry Point
The redirect is a symptom. The root cause is how they got in: an outdated plugin, a nulled theme, a compromised admin account, or weak file permissions. You must fix the entry point or you will be reinfected — usually within days. Common culprits are plugins with known vulnerabilities (check the WPScan vulnerability database) and outdated PHP versions. Our WordPress security best practices post has the hardening checklist.
6. Submit a Reconsideration Request to Google
If you received a manual action in GSC, cleaning the site is not enough — you have to tell Google you've fixed it.
- Verify in GSC that the manual action is listed under Security & Manual Actions
- Document every step of your cleanup
- Resubmit your legitimate sitemap
- Click "Request Review" and explain what you fixed, specifically
Timeline: Google typically responds within 2-4 weeks for manual action reviews. Crawl re-indexing after a successful review usually takes another 4-8 weeks for full ranking recovery. Plan for a 60-90 day recovery window — with no shortcuts.
Why Reinfection Happens (And Why It Will Happen Again Without This)
According to Sucuri's 2024 Website Threat Research Report, 52% of cleaned WordPress sites are reinfected within 30 days. That's not because the cleanup was done wrong — it's because the underlying conditions weren't changed. Outdated plugins get patched, but then an admin reuses a compromised password. A clean theme file gets restored, but the server still has 777 permissions on /uploads. The attack surface remains.
This is exactly why managed WordPress hosting exists as a category. The value isn't just faster load times — it's the operational layer between you and this cycle.
How Managed Hosting Prevents This Before It Destroys Your Rankings
Here's the honest pitch: if you're running a site where organic traffic matters — and losing rankings for 60-90 days is genuinely costly — the math on managed hosting changes fast.
At TopSyde, TopSyde Sentinel runs daily server-level scans across every site we host. It's looking specifically for the patterns described above: conditional redirect logic, encoded injections in core files, unauthorized modifications to .htaccess, rogue PHP files, and database anomalies. Critically, it scans below the WordPress application layer, where plugin-based scanners can't reach.
When Sentinel flags something, we don't just alert you — we investigate and act. Our team responds in under 2 hours during business hours. For a site running five figures a month in organic-driven revenue, the $89/mo starting price is insurance, not overhead.
Compare that to the alternative: a freelance malware removal service typically runs $200-$500 per incident. A missed redirect hack that tanks rankings for three months on a site doing $15,000/month in revenue can cost $45,000 in lost traffic — conservatively. The math isn't close.
For agencies managing multiple client sites, the exposure is multiplied across every site in your portfolio. One infected client site can trigger a Google manual action that spreads concern to your agency's reputation. We built our agency hosting offering specifically around this risk profile — daily scanning, isolated environments, and white-label reporting so you can communicate proactively with clients before they notice the problem themselves.
If you're weighing whether the cost is justified, our honest breakdown of managed WordPress hosting ROI will give you the numbers without the marketing spin.
And if you're currently on a host like GoDaddy or a generic shared host with no server-side scanning, the migration to managed WordPress hosting is simpler than most people expect — we handle it for you.
What Google's Recovery Timeline Actually Looks Like
I want to be direct about expectations here, because a lot of cleanup guides imply you'll recover rankings quickly once the site is clean. You won't — not always.
| Recovery Milestone | Typical Timeline |
|---|---|
| Manual action review response | 2–4 weeks |
| Initial crawl of cleaned pages | 2–4 weeks post-review |
| Spam URLs deindexed | 4–8 weeks |
| Ranking recovery to pre-hack levels | 2–6 months |
| Full authority recovery (if significant | May never fully return |
The last row is the one people don't want to hear. If your domain was used to spam Google for months before you caught it, your domain's trust score takes a hit that can linger. The best outcome is catching it within days — which is why the monitoring layer matters more than the cleanup speed.
If your site is currently showing signs of a redirect hack — or if you're running WordPress without server-level scanning and want to stop being reactive — start with a TopSyde plan at $89/mo. We migrate you, scan on day one, and back it with a 30-day money-back guarantee. The reinfection cycle stops when the entry points are monitored continuously, not patched after the fact.
Frequently Asked Questions
How do I know if my WordPress site has been redirect-hacked?
Check Google Search Console for manual actions, unexpected sitemap submissions, or security issue warnings. Then test your site using a Googlebot user agent — tools like curl or a user agent switcher browser extension will reveal conditional redirects that only fire for search engine traffic. A sudden unexplained drop in organic traffic is the most common first symptom.
Can I recover my Google rankings after a redirect hack?
Yes, but it takes time. Once the site is fully cleaned and you've submitted a reconsideration request (if a manual action was issued), expect a 60-90 day recovery window before rankings return to pre-hack levels. If the hack ran undetected for months, full authority recovery may take longer or remain partial. Speed of detection is the single biggest factor in how much damage is done.
Why does the redirect hack keep coming back after I clean it?
Reinfection happens when the original entry point isn't fixed alongside the malicious code. Common causes include outdated plugins with known vulnerabilities, compromised admin credentials, leftover backdoor files in unexpected directories, or insecure file permissions. A cleanup that only removes the visible redirect code without addressing root cause typically results in reinfection within 30 days.
Will reinstalling WordPress fix a redirect hack?
Not reliably. Reinstalling WordPress replaces core files but leaves your database, plugins, theme files, and any rogue PHP files outside the WordPress directory completely untouched. Most redirect injections survive a core reinstall. You need a full server-level scan and database audit, not just a file replacement.
Does managed WordPress hosting prevent redirect hacks?
Managed hosting with active server-level scanning significantly reduces both the risk and the impact window. It won't prevent every attack — no system does — but it catches injections before they've had weeks to damage your rankings. TopSyde Sentinel scans at the server layer daily, which is the layer where redirect injection code actually lives.
Topics
DevOps & Security Lead
12+ years DevOps, Linux & cloud infrastructure certified
Marcus leads infrastructure and security at TopSyde, managing the server fleet and AI monitoring systems that keep client sites fast and protected. Former sysadmin turned WordPress hosting specialist.
