Skip to content
EVI Solutions

Site redirects to another domain: malware removal

Medium 45 min Updated:

Quick answer

A redirect to another domain is most often caused by malware in theme files, plugins, or the database. You need to make a backup, find the malicious code, remove it and clean the database, then change passwords and update all components.

How to recognize the problem

  • The site automatically redirects to an unknown domain
  • Google search shows unwanted results or warnings
  • Pop-ups or ads appear
  • The site admin runs slower or behaves strangely
  • Some files are modified or missing

Most common causes

Malicious code in files

Attackers inject scripts into `index.php`, `functions.php`, or other theme and plugin files. These scripts redirect visitors to another domain.

Database infection

Malware can be stored in database tables, for example in options or posts. WordPress loads and executes it every time a page is opened.

Compromised accounts

If an administrator account is compromised, an attacker can add malicious code or change site settings.

Outdated plugins and themes

Old versions of plugins and themes have known vulnerabilities that attackers use to inject malware.

Step-by-step fix

  1. 1

    Make a backup

    Before any changes, make a complete backup of files and database. Use a backup plugin or tools provided by your hosting. Save the copy in a safe place outside the site.

  2. 2

    Put the site in maintenance mode

    Temporarily disable access to the site so visitors are not redirected while you clean. You can use a maintenance mode plugin or an .htaccess rule. Do not forget to turn it off later.

  3. 3

    Scan the site for malware

    Install a reliable security plugin such as Wordfence, Sucuri Security, or MalCare. Run a scan and review the results. Pay attention to modified files and suspicious database entries.

  4. 4

    Review suspicious files

    Via FTP or the file manager on your hosting, review theme and plugin files. Look for unusual code, such as eval, base64_decode, iframe, or scripts that redirect to another domain. Also check the .htaccess file in the site root and the wp-config.php file, as malicious redirects are often found there. Pay attention to files with recent modification dates.

  5. 5

    Remove the malicious code

    Delete or clean infected files. If you are not sure which file is original, download a fresh copy of the theme or plugin from the official source and replace the entire folder. Do not delete files that belong to the WordPress core, but replace them with new ones.

  6. 6

    Clean the database

    Check the wp_options, wp_posts, and wp_postmeta tables for suspicious entries (the table prefix may be different from wp_). In the options table, also check the siteurl and home values, as redirects are often set there. You can use a tool like phpMyAdmin or a database cleaning plugin. Remove unknown options and scripts. Make a database backup before changes.

  7. 7

    Change passwords and keys

    Change the password for WordPress admin access, hosting panel, and FTP account. If you suspect the administrator account is compromised, change passwords as soon as possible, even before cleaning files. Also, change the security keys in the wp-config.php file by generating new ones from https://api.wordpress.org/secret-key/1.1/salt/.

  8. 8

    Update all components

    Update the WordPress core, all plugins, and themes to the latest versions. Delete inactive plugins and themes you do not use, but first check that you do not need them and that you have a backup. Regular updates prevent reinfection.

  9. 9

    Rescan and test

    After cleaning, run the security plugin scan again. Open the site in a browser and check if the redirect still occurs. If everything is fine, turn off maintenance mode.

If nothing helps

If the redirect returns even after thorough cleaning, malware may be deep in the database or the hosting account may be compromised. In that case, contact hosting support and request a detailed server check. You can also restore the site from a backup made before the infection, but immediately update all components and change passwords so the infection does not recur. For advanced cases, hire a WordPress security expert.

How to prevent it

  • Regularly update WordPress, plugins, and themes
  • Use strong passwords and two-factor authentication
  • Install only reliable plugins and themes from official sources
  • Regularly make backups and keep them off-site

When to call a professional

If you are not sure how to safely clean the database or files, or if the infection recurs, contact an IT expert for WordPress security.

Let us handle it Ask the AI IT assistant
Website development · Fast, SEO-ready, multilingual websites

FAQ

How do I know if my site is infected with malware?

Signs include redirects to another domain, pop-ups, modified files, and warnings in Google search. Security plugins can detect malicious code.

Is it enough to just delete infected files?

No, malware can also be in the database. You need to clean the database, change passwords, and update all components.

How often should I scan the site?

Weekly scanning with a security plugin is recommended, as well as after any major change on the site.

Share
Didn't find a fix?The AI IT assistant is available 24/7. Describe the problem or send a screenshot of the error and get instructions for your case.Ask the AI IT assistant