My website redirects to a malicious page

Summary

This guide helps you troubleshoot and resolve: My website redirects to a malicious page. Follow the steps below to fix the issue.

Common Causes

If visitors to your business website are being redirected to unfamiliar pages or seeing security warnings, your hosting account or content management system may have been compromised. These redirects are often caused by unauthorised changes to core files, malicious plugin installations, or altered DNS settings. This article explains how to identify the source of the redirect, secure your website environment, and restore normal traffic flow for your customers.

Quick Fix Steps

1. Visit your website from an incognito or private browser window to confirm the redirect.
2. Scan your local computer for malware that may have stolen your hosting or FTP credentials.
3. Access your hosting control panel and immediately change your FTP, database, and administrator passwords.
4. Check your DNS records to ensure no unauthorised changes have been made to your A records or nameservers.
5. Scan your website files for malicious code or recently modified scripts.
6. Restore your site from a clean backup taken before the compromise occurred.

Detailed Instructions

1. Verify the Redirect

1. Open a private or incognito browser window.
2. Navigate to your website's domain.
3. Observe whether the page loads correctly or redirects to an unfamiliar URL.
4. Check the browser address bar for any security warnings or certificate errors.

2. Secure Your Hosting Account

1. Log in to your hosting control panel.
2. Navigate to the user or security settings section.
3. Update your account password, FTP credentials, and database password.
4. Review the list of authorised users and remove any accounts you do not recognise.
5. Enable two-factor authentication if your control panel supports it.

3. Inspect DNS Settings

1. Log in to your domain registrar or DNS management portal.
2. Review your A records, CNAME records, and nameserver entries.
3. Compare the current values against your known correct settings.
4. If you find unauthorised entries, update them to point to the correct hosting IP address.
5. Allow time for DNS changes to propagate across the internet.

4. Scan and Clean Website Files

1. Connect to your hosting account using an FTP client or the file manager in your control panel.
2. Sort files by date modified to identify any files changed recently without your knowledge.
3. Pay close attention to core files such as index.php, .htaccess, and wp-config.php if you use WordPress.
4. Look for obfuscated code, unfamiliar base64 strings, or suspicious JavaScript injections.
5. Download a clean copy of your content management system and replace any compromised core files.
6. Check your .htaccess file for unauthorised rewrite rules and remove any suspicious lines that redirect visitors to spam or phishing pages.

5. Remove Malicious Plugins and Themes

1. Log in to your website administrator dashboard.
2. Navigate to the plugins or extensions section.
3. Deactivate and delete any plugins you did not install or that were recently added without authorisation.
4. Review your active theme and switch to a default theme if you suspect the current theme has been modified.
5. Update all remaining plugins, themes, and the core platform to their latest versions.

6. Restore from a Clean Backup

1. Access your hosting control panel's backup or restoration tool.
2. Select a backup created before the redirect issue began.
3. Restore your website files and database to that point in time.
4. Test your website thoroughly to ensure the redirect no longer occurs.

7. Update All Passwords Again

1. After cleaning your site and restoring from backup, change your hosting control panel, FTP, database, and CMS administrator passwords once more.
2. This ensures any credentials stolen during the compromise are no longer valid.

Troubleshooting

Redirect persists after cleaning files

If the redirect continues, check your .htaccess file for unauthorised rewrite rules. Malicious actors often insert redirect rules here that send visitors to spam or phishing pages. Download the file, remove any suspicious lines, and re-upload it.

Security warnings in search results

If Google or other search engines are flagging your site, request a review through the search engine's webmaster tools once you have cleaned the malware. This process can take several days, but it helps restore visitor trust and search rankings.

Hosting account suspended

Some hosting providers suspend accounts when malware is detected to protect other customers. If your site is offline, check your email for a suspension notice from your hosting provider. You will need to clean the infection before requesting reactivation.

Still Having Issues?