Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is a Malicious Redirect?

Definition

A malicious redirect is code an attacker adds to a hacked website that sends some visitors somewhere else: a scam page, fake tech support, a phishing site, or spam. Google's spam policies describe hackers injecting code that "redirects some users to harmful or spammy pages," and note the redirect often depends on the referrer, user agent, or device.

How It Works

Attackers get in through a vulnerable plugin or theme, a stolen admin password, or an existing backdoor, then plant the redirect in one of several places:

  • JavaScript injected into pages, theme files, or the database (widgets and options).
  • Server rules in .htaccess that rewrite or redirect requests.
  • PHP code in theme, plugin, or core files that decides who to redirect.

The key feature is that the redirect is conditional. Google gives the example of a visitor who clicks a result in Google Search and is redirected, while the same URL typed into a browser shows nothing wrong. GoDaddy's 2025 website malware report, based on its SiteCheck scanner, describes redirects that activate only for visitors from search engines, certain regions, or certain devices, and that avoid known security scanners and site owners. That is why owners often say, "It works fine for me."

Many redirects feed a traffic distribution system (TDS) that profiles each visitor and routes them to whichever scam pays the most.

Real-World Example

In April 2023, Sucuri published its synopsis of Balada Injector, a WordPress infection campaign it had tracked since 2017. Sucuri estimated that over one million WordPress websites had been infected by the campaign, which exploited known and newly disclosed theme and plugin vulnerabilities, sometimes within hours of disclosure, and redirected visitors to scam sites. GoDaddy's 2025 report says Balada Injector effectively stopped active operations in 2025 but was still detected on 11,701 websites as legacy infections, some now redirecting to domains re-registered by spammers.

Why It Matters for a Small Business

GoDaddy's research team reported malicious redirects in 202,122 detections in 2025, 21.7% of all threats its scanner flagged. GoDaddy notes the data covers sites its own scanner examined, not the whole web. For a small business, a redirect sends paying visitors to scams under your name, and Google's spam policies treat injected redirects as hacked content. Because the redirect hides from the owner, it can run for weeks before anyone notices. GoDaddy also reports that after the VexTrio/LosPollos traffic system was disrupted in late 2024, a successor called Help TDS emerged to route traffic for malware campaigns, specializing in fake tech support scams.

How to Spot It / How DTS Handles It

Signs: customers say your site "went to a weird page"; redirects only from Google results or on mobile; unfamiliar script tags or domains in page source; recent .htaccess changes; and Search Console security warnings.

DTS takes a forensic backup of files and the database first, tests the site as a searcher and as a mobile visitor, checks Google Safe Browsing, and traces the redirect to its source in .htaccess, options, posts, or PHP. With the owner's approval we remove it and the backdoor behind it, rotate salts and passwords, verify the fix, and request a review in Search Console if Google flagged the site. See our hacked WordPress cleanup service, or our guide to the WordPress redirect hack.

Related Terms

  • SEO spam: redirects and spam pages often arrive together.
  • Cloaking: showing search engines one thing and visitors another.
  • Backdoor: the reason redirects return after cleanup.
  • Plugin vulnerability: the most common way campaigns like Balada got in.
  • Malvertising: malicious ads that lead to the same scam networks.
  • Open redirect: a related flaw in legitimate code.

Sources

  • Google Search Central, Spam policies for Google web search (hacked content: redirects): https://developers.google.com/search/docs/essentials/spam-policies
  • GoDaddy, GoDaddy Annual Cybersecurity Report: Website Malware Threat Landscape (2025 data, vendor research): https://www.godaddy.com/resources/news/godaddy-annual-cybersecurity-report
  • Sucuri, Balada Injector: Synopsis of a Massive Ongoing WordPress Malware Campaign (April 2023): https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

Last updated October 14, 2026.