[{"data":1,"prerenderedAt":172},["ShallowReactive",2],{"publication:en:P048":3},{"meta":4,"copy":18,"relatedArticles":135,"terms":164,"term":165,"resourceParent":166,"glossaryParent":169},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":16,"preparedOn":17},"P048","\u002Fblog\u002Fwordpress-malicious-redirect","article","WordPress site redirecting to another site","WordPress site redirecting to another site: trace the source","WordPress site redirecting to another site? Diagnosis","Trace unwanted WordPress redirects across DNS, server rules, plugins and browser scripts. Preserve evidence, contain exposure and verify the repaired visitor paths.",[13,14,15],"\u002Fservices\u002Fwebsite-recovery","\u002Fservices\u002Fwordpress-support","\u002Femergency","2026-10-26","2026-10-30",{"intro":19,"sections":20,"checklistTitle":85,"checklist":86,"faq":94,"sources":104,"links":109,"cta":130},"If your WordPress site is redirecting to another site, record the affected address and the conditions before changing settings. An unwanted redirect can originate in DNS or hosting, server rules, WordPress configuration, injected content or a browser-side script. Preserve evidence, protect visitors from the affected path and locate the first unexpected step; deleting the final destination or changing a password alone may leave the cause in place.",[21,26,62,67,75,80],{"title":22,"paragraphs":23},"Capture the visitor path without completing a suspicious journey",[24,25],"Write down the original URL, approximate time with timezone, device, whether the visitor was signed in and how they arrived. A redirect that appears only after a search click or on mobile needs that context. Ask for the warning or destination shown, rather than asking a customer to repeat a potentially harmful interaction or enter information on the destination.","An authorized technician can inspect the redirect chain and page behavior in a controlled environment. Distinguish the first unexpected hop from later advertising or scam destinations. Preserve relevant response details, available logs and a copy of the affected state before cleanup changes. Do not publish session-bearing URLs or complete private request headers in a support thread.",{"title":27,"paragraphs":28,"table":31,"sources":58},"Locate the layer that changes the destination",[29,30],"HTTP redirects, HTML refresh behavior and JavaScript navigation are different mechanisms. A changed DNS answer can route a hostname to a different server before any page redirect occurs. The address bar alone cannot identify which layer made the decision. Compare the response and the code that produced it with the intended hosting and application configuration.","Use the matrix to assign the next check to the person who owns that layer. A suspicious database value does not rule out a server rule, and a clean homepage does not settle what a specific landing page loads. Keep the observations separate until there is evidence linking them.",{"caption":32,"headers":33,"rows":37},"Find the first unexpected change",[34,35,36],"Observed stage","Check with the authorized owner","Avoid concluding",[38,42,46,50,54],[39,40,41],"Wrong host receives the request","DNS answers, delegation and intended hosting target","That a WordPress plugin caused it.",[43,44,45],"Server returns an unexpected Location","Hosting\u002FCDN redirect rules and application response","That deleting page text will fix it.",[47,48,49],"Page loads, then navigates away","Loaded scripts, injected markup and embedded resources","That DNS is necessarily wrong.",[51,52,53],"Only one browser is affected","A clean comparison and local browser extensions","That every visitor is safe.",[55,56,57],"Only selected visitors are redirected","Entry page, referrer\u002Fdevice conditions and evidence window","That an administrator test disproves the report.",[59],{"label":60,"url":61},"MDN: HTTP, HTML and JavaScript redirections","https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FHTTP\u002FGuides\u002FRedirections",{"title":63,"paragraphs":64},"Contain exposure while retaining a recovery path",[65,66],"If visitors are being sent to a harmful destination, agree a targeted restriction or a temporary service notice with the business owner and hosting provider. Decide how enquiries or orders will be handled through an existing trusted channel. Containment is a business decision as well as a technical one; record who approved it and what remains available.","Preserve evidence before purging logs or overwriting the installation. Avoid a public maintenance page that repeats the attacker destination as a clickable link. If payment or account information may have been exposed, include those systems in the response scope instead of treating the incident as a cosmetic website fault. The initial incident guide covers broader response responsibilities.",{"title":68,"paragraphs":69,"example":72},"Correct the entry point and persistence, not only the symptom",[70,71],"Review the implicated files, database content, users, scheduled tasks and relevant hosting configuration within the authorized scope. Compare components with trusted releases and the business's known customizations. Replacing one altered file may remove a symptom while leaving another mechanism that restores it. A detection tool can help locate evidence, but its clean result is not a complete causal explanation.","Plan updates or replacement of the vulnerable component, correction of unauthorized access and appropriate credential\u002Fsession handling from a trusted device. If restoring a backup, establish why the copy predates the compromise and how recent business records will be preserved. A restore that reintroduces the vulnerable component needs another corrective step.",{"title":73,"text":74},"Illustrative conditional redirect","The owner sees a normal homepage while a signed-out mobile visitor arriving from search is redirected from a product page. Repeating only the owner's homepage test misses the reported condition. The acceptance plan must include the original product path and comparable visitor conditions.",{"title":76,"paragraphs":77},"Retest the original conditions and the business workflow",[78,79],"Create a small test register: original URL, device\u002Fsession condition, expected destination, actual first hop, timestamp and reviewer. Include affected landing pages, direct visits, search-entry behavior where reproducible and the important form or checkout route. Inspect relevant caches and content delivery paths after the underlying change rather than assuming a cache purge repairs the source.","Retest after the change and schedule a follow-up observation appropriate to the evidence. A normal request at one moment does not establish that conditional behavior can never recur. Record what was checked, any remaining unknowns and who investigates a recurrence. If Google also shows a security warning, complete the separate cleanup-and-review process for that report.",{"title":81,"paragraphs":82},"Prepare a useful handover or request for help",[83,84],"Provide the affected address, time, entry route, visible symptom and any authorized changes already made. Identify who controls DNS, hosting, WordPress and third-party scripts. Keep passwords and private logs out of the initial form. When access is agreed, use an appropriate controlled route rather than forwarding reusable administrative secrets in a message.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide, specializing in websites and digital infrastructure. Our Israeli technical knowledge is applied through scoped diagnosis, repair and verification for the actual platform involved. We can discuss website recovery and WordPress security work; the access, availability and acceptance checks are agreed for the situation.","Redirect investigation and acceptance record",[87,88,89,90,91,92,93],"Original URL, first unexpected hop and observation time","Visitor device, session and entry conditions","Owner of the implicated DNS, server or application layer","Evidence preserved before cleanup","Entry point and persistence addressed separately","Original conditions and critical business journeys retested","Remaining uncertainty and follow-up owner recorded",[95,98,101],{"question":96,"answer":97},"Does an unwanted redirect prove that WordPress was hacked?","It can indicate compromise, but it does not identify the cause by itself. DNS or server configuration, a third-party script and a local browser problem are different possibilities. Locate the first unexpected change and compare conditions before choosing a repair.",{"question":99,"answer":100},"Why does the redirect disappear when I log in?","Behavior can depend on the visitor's session, entry route, device or a cached response. A normal administrator visit therefore does not disprove a customer report. Preserve the reported conditions and include a controlled signed-out comparison in the investigation.",{"question":102,"answer":103},"Will restoring yesterday's backup solve it?","Only if the copy is suitable and the underlying entry point and access issues are addressed. Preserve current business data, establish the copy's provenance and retest the original paths. An apparently clean restore can retain the component or account weakness that enabled the problem.",[105,106],{"label":60,"url":61},{"label":107,"url":108},"WordPress: responding to a compromised site","https:\u002F\u002Fwordpress.org\u002Fdocumentation\u002Farticle\u002Ffaq-my-site-was-hacked\u002F",[110,112,115,118,121,124,127],{"path":13,"label":111},"Discuss scoped website recovery",{"path":113,"label":114},"\u002Fservices\u002Fwordpress-security","Review WordPress protection and hardening",{"path":116,"label":117},"\u002Fblog\u002Fwebsite-hacked-first-steps","Take the first steps after a suspected compromise",{"path":119,"label":120},"\u002Fblog\u002Fgoogle-dangerous-site-warning","Handle a Google dangerous-site warning",{"path":122,"label":123},"\u002Fblog\u002Fbackup-restore-test","Verify a backup before relying on it",{"path":125,"label":126},"\u002Fblog\u002Fdns-change-checklist","Plan changes to the domain routing",{"path":128,"label":129},"\u002Fglossary\u002Fmalware","Separate malware evidence from an unexplained redirect",{"title":131,"description":132,"button":133,"type":134},"Investigate the redirect at its source","Describe the affected page, visitor conditions and when the behavior appeared. We can clarify the evidence and recovery scope before making changes.","Discuss a website redirect","fix",[136,144,150,156],{"id":137,"path":138,"title":139,"description":140,"category":141,"artwork":141,"order":142,"publishedOn":143},"P054","\u002Fblog\u002Fwordpress-security-checklist","WordPress security checklist for small business owners","A practical WordPress security checklist covering ownership, updates, accounts, backups and integrations. Includes acceptance checks, stop conditions and clear responsibilities.","websites",91,"2026-11-01",{"id":145,"path":119,"title":146,"description":147,"category":141,"artwork":141,"order":148,"publishedOn":149},"P053","Google says your website is dangerous: cleanup and review","Identify the Google warning, review Security Issues, address affected pages and embedded resources, and prepare a security review after verified repairs.",74,"2026-10-20",{"id":151,"path":116,"title":152,"description":153,"category":141,"artwork":141,"order":154,"publishedOn":155},"P047","My website has been hacked: what should I do first?","A practical first-response guide for a suspected website compromise: document symptoms, coordinate containment, protect evidence and plan recovery without overwriting new data.",99,"2026-11-05",{"id":157,"path":158,"title":159,"description":160,"category":141,"artwork":161,"order":162,"publishedOn":163},"P057","\u002Fblog\u002Fwordpress-plugin-vulnerability-response","Vulnerable WordPress plugin: decide what to fix first","Confirm affected versions, prerequisites and exposure. Plan an update, restriction or replacement, test business workflows and investigate compromise separately.","security",66,"2026-10-14",[],null,{"path":167,"label":168},"\u002Fresources","Website security resources and templates",{"path":170,"label":171},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058725]