Threat library
Malicious Redirects
Conditional redirects send your mobile or search visitors to scam pages while the site looks normal to you. How they are implemented and how to trace them.
Published 25 Jun 2026 · Updated 22 Aug 2026 · 2 min read
Short answer
A malicious redirect is injected code on a compromised website that sends visitors to an attacker-controlled destination, usually only under specific conditions such as arriving from search results, using a mobile device, or visiting for the first time, which is why the site appears normal to its owner.
Where do malicious redirects live?
| Location | Typical form | How to check |
|---|---|---|
| Server configuration | .htaccess or nginx rules keyed on user agent or referrer | Review config files and compare against version control |
| Application code | A header() call in an include loaded on every request | Diff core, theme and plugin files against official releases |
| Database content | Injected script tags in post content or site options | Search stored content for script tags and unfamiliar domains |
| Third-party script | A compromised or hijacked analytics, ad or widget script | Watch the network waterfall for the first request to the redirect domain |
How do you reproduce a redirect you cannot see?
STEP 01
Use a clean session
Open a private window, or clear cookies. Many redirect payloads fire once per visitor and then set a suppression cookie.
STEP 02
Emulate a mobile device
Switch to a mobile user agent in devtools. Mobile-only redirects are the most common variant.
STEP 03
Arrive from search
Set a search engine referrer, or click through from a search result, since many payloads check the referrer.
STEP 04
Capture the full chain
Record every hop with response codes and the initiator of each request. The initiator tells you which file or script triggered it.
curl -sIL -A "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X)" \
-e "https://www.google.com/" https://example.com/ | grep -Ei "^(HTTP|location)"How do you remove a malicious redirect?
- Identify the initiator from the captured chain before editing files.
- Restore the affected config or code file from a known-good copy.
- Clean injected script tags from the database, including cached fragments.
- Remove or pin third-party scripts you do not control; add Subresource Integrity where the provider supports it.
- Purge caches and CDN, then re-test with the same mobile and referrer conditions.
- Rotate credentials and check for backdoors and scheduled tasks.
What damage do malicious redirects cause?
The visible cost is lost traffic and conversions. The larger costs are a browser-level Deceptive Site warning, removal from search listings, and the reputational damage of customers landing on scam pages carrying your brand. Because the redirect is conditional, this can continue for weeks before anyone internally reproduces it.
Sources
- Fixing hacked sites: unwanted redirects — Google Search Central
- Subresource Integrity — MDN Web Docs
Prefer summary updates? Subscribe to the newsletter.