Phone visitors redirect, desktop looks normal

That is not a glitch. It is one of the most common WordPress compromise patterns, and it is built to hide from the site owner. The redirect only fires for certain visitors (phones, people arriving from Google, people who are not logged in, first-time visitors) so the person most likely to fix it is the one least likely to see it. This post covers what owners usually see, how these redirects usually work, what not to do in the first hour, and why this one usually means booking cleanup instead of DIY. It is not a full malware-removal guide. We do not promise ranking recovery dates or Safe Browsing clear times.

If you only just found out, skim our first 24 hours after a WordPress hack guide. The shorter symptom page WordPress redirect hack covers the same panic pattern in fewer words.

What owners usually see

• Customers, staff, or a friend report being sent to a scam, prize, pharmacy, or adult page from your site
• It happens on phones but not on your desktop, or only when someone clicks through from Google
• It happens once per visitor, then stops, so it "can't be reproduced" on a second try
• Your own logged-in browser never sees it
• Ads accounts flag or pause your landing pages for "malicious or unwanted software"
• Chrome or Google Search Console starts warning about the site, or spam titles show up in search results

Related live guides if you recognize a sibling pattern:

• WordPress redirect hack (short page)
• Casino titles in Google while the site looks fine logged in
• Spam links keep coming back after I delete them
• Chrome says this site may be hacked
• Don't wipe the host yet: why blind restores hide the door
• Unknown WordPress administrator appeared overnight

How these redirects usually work

At a pattern level (not a claim about your specific site), a conditional redirect usually lives in one or more of these places:

• Injected JavaScript. A script added to a theme file, a plugin file, or a database option that checks the visitor's device, referrer, or cookies before sending them away.
• Server rules. Lines added to .htaccess (or a similar server config) that redirect only mobile browsers or visitors coming from search engines.
• A planted or infected plugin. A plugin with a harmless-looking name, or a real plugin with modified files, that runs the redirect logic.
• Database content. Script tags hidden inside posts, widgets, or site settings, so cleaning files alone does not fix it.

Most of these deliberately skip logged-in administrators and repeat visitors. Many also leave a second copy somewhere else, so removing the one you find often looks like it worked until the next customer complains (see spam keeps coming back).

First-hour don'ts (preserve, then contain)

1. Do not start deleting files or editing .htaccess by guesswork. Write down what visitors reported: device, browser, where they came from, the page they landed on, and the time. Screenshots or screen recordings from a phone help.
2. Do not wipe the host or restore last night's backup before you have a full files-plus-database copy stored off the server (see don't wipe the host yet). The redirect code may already be inside that backup.
3. Do not keep sending paid traffic into it. If you run ads to the site, pausing them while the site is redirecting protects your visitors and your ad account.
4. Change passwords from a clean device for every WordPress administrator, the hosting panel, SFTP, and the database. Turn on two-factor sign-in where you can.
5. Avoid random "redirect fix" plugins and forum snippets pasted into functions.php on a still-compromised site.
6. Do not assume it is fixed because you cannot see it. Test logged out, on a phone using mobile data, and by clicking through from a Google search for your business.
7. Use the free WordPress compromise checklist to preserve evidence and decide what is safe to touch. It does not fully clean a compromised site by itself.

When to stop and call (this one is usually a call)

A live redirect is harming your visitors right now, so this is usually a booking, not a weekend DIY project. Use WordPress incident response when any of these are true:

• Real customers or staff are being sent to another site
• Your ad account flagged or paused the site
• Chrome, Google, or Search Console is warning about the site
• You removed something and the redirect came back
• WooCommerce, payments, booking, or lead forms need to stay up while cleanup happens carefully
• You need a written report of what was found, removed, and rotated

If you still control the site, nothing customer-facing is broken yet, and you only have one unconfirmed report, start with the checklist and test from a phone before deciding.

Published cleanup packages start around $2,500 (typical ranges and combined cleanup and hardening options are on the IR page). Work is remote nationwide; Tri-Cities and Western NC onsite is by appointment.

What careful cleanup usually means (expectations)

• Preserve evidence first (off-server files and database), then reproduce the redirect the way real visitors see it
• Find every copy of the redirect logic: theme and plugin files, .htaccess and server rules, planted files, and database content
• Remove it and whatever put it there, then check the homepage and key pages (forms, cart, booking) logged out and on mobile
• Rotate access for WordPress, hosting, SFTP, the database, and the email behind each admin
• Close the original door where it can be identified, such as an outdated plugin, a stale account, or a reused password
• Deliver a written report of what was removed, what access was rotated, and what still needs an owner step (ads account review, Search Console, host panel)
• We do not promise Google timelines, ad account reinstatement dates, Safe Browsing clear dates, or ranking recovery dates

After cleanup, hardening and ongoing Care ($149 / $249 / $399) are optional next steps so the same door is less likely to reopen. They do not replace cleanup while the site is still compromised.