Unexpected redirects can be intermittent or limited to certain visitors, which makes them easy to miss during a quick office check.
What to check
- Do not ignore intermittent redirects
- Preserve logs and a clean backup if available
- Change credentials from a trusted device
What the results mean
Preserve evidence, inspect access and injected code, and change credentials from a trusted device. A clean page alone does not prove the infection is gone.
Treat intermittent redirects seriously
Malicious redirects may appear only to new visitors, search traffic, or particular devices. Record the destination and conditions, then preserve logs and a current copy of files and database. Check unfamiliar admin accounts, plugins, theme files, scheduled tasks, and injected scripts. Avoid visiting suspect destinations on a business computer.
Close the route back in
Remove the malicious changes, rotate affected credentials, update vulnerable components, and verify that the attacker has no remaining access. Test from clean browsers and monitor search warnings. Simply deleting the visible redirect can leave the mechanism that created it in place.
Will a clean backup solve it?
Only if the backup predates the compromise and the entry point is also corrected.
Greg Grigorian
If this issue affects inquiries or day-to-day work, get the cause checked and the important customer paths tested after repair. Greg can handle the website work directly.