Redirect Scanner

Injected redirect code branches on user agent, referrer and cookies, and often fires once per visitor. Testing one profile from one session is the most common reason a compromised site is declared clean.

• Owners receiving reports that visitors — often only mobile visitors — land somewhere unexpected, while the site looks fine to them.
• Teams migrating domains or restructuring URLs who need to confirm the intended redirect map and nothing more.
• Anyone who has been told their site redirects to spam but cannot reproduce it from their own desk.
• Publishers auditing third-party ad or tag scripts suspected of triggering redirects.

A conditional redirect monetises your organic traffic while leaving your own experience untouched, which is why it survives so long. The visitor never reaches your page, so the loss shows up as falling engagement and conversions rather than as an obvious defacement, and the owner's own tests keep coming back clean.

• Search: Google may classify the URL as hacked content and remove it from results.
• Revenue: organic sessions are diverted before they reach a product or lead form.
• Reputation: destinations are commonly counterfeit stores, fake update prompts or malware droppers.
• Diagnosis: rotating intermediate hops make the destination a moving target, so the chain is the evidence that matters.

• It cannot tell you which file or database row contains the redirect code; it tells you where the chain leaves your domain, which narrows the search.
• It cannot reproduce every condition — some payloads gate on geography, ISP, device fingerprint or a one-visit cookie.
• It cannot distinguish an injected redirect from a misconfigured legitimate one without your intended redirect map for comparison.
• It cannot follow redirects that require a logged-in session.

1. STEP 01

   Record the full chain

   Capture every hop with status codes and the request conditions that triggered it. You need this to verify the fix.

2. STEP 02

   Decide server-side or client-side

   A hop present in response headers is server-side (platform config, .htaccess, application code). A hop with no header evidence is JavaScript or a meta refresh — inspect the initiator in the browser network panel.

3. STEP 03

   Check third-party scripts before your own code

   If the initiator is an ad, tag manager or analytics script, the fix belongs with that provider or that tag's configuration.

4. STEP 04

   Clean, then close the entry point

   Restore affected files from source, remove persistence, and rotate credentials — otherwise the redirect returns with a new destination.

5. STEP 05

   Re-test across profiles

   Repeat desktop, mobile and search-referrer requests after cache purges, then again 24 hours later.