Why does my website keep redirecting to spam pages?

Summary

This guide helps you troubleshoot and resolve: Why does my website keep redirecting to spam pages?. Follow the steps below to fix the issue.

Common Causes

Unexpected website redirects occur when visitors are sent to pages they did not request, often leading to spam, phishing sites, or malicious downloads. This behaviour is typically caused by compromised website files, injected malicious code, or unauthorised changes to your site's configuration. Left unresolved, these redirects can destroy visitor trust and harm your search engine rankings.

Remember — If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Quick Fix Steps

1. Scan your website files for unfamiliar code or recently modified scripts.
2. Restore your site from a clean backup taken before the redirects began.
3. Update all website software, including your content management system, themes, and plugins.
4. Change all administrative, FTP, and database passwords.
5. Remove any unrecognised administrator users from your website dashboard.

Detailed Instructions

1. Identify the Source of the Redirect

1. Open your website in an incognito or private browser window to bypass cached redirects.
2. Use your browser's developer tools (F12 on Windows, Command + Option + I on macOS) to inspect network requests and identify where the redirect originates.
3. Check your website's root directory for recently modified files, particularly .htaccess, index.php, and wp-config.php.
4. Review your website's admin dashboard for any plugins or extensions you did not install.

2. Clean Affected Files

1. Download a fresh copy of your website's core files from the official vendor.
2. Compare your current files against the clean versions to spot injected code.
3. Remove any suspicious JavaScript, iframe embeds, or encoded strings found in template files.
4. Check your .htaccess file for unauthorised rewrite rules that force redirects to external domains.
5. Scan your website using a reputable security scanner to identify remaining malware.

3. Update Software and Credentials

1. Log in to your website's admin panel and navigate to the updates section.
2. Install all available updates for your content management system, themes, and plugins.
3. Delete any unused plugins or themes, as outdated inactive extensions can still be exploited.
4. Change your hosting control panel password, FTP/SFTP password, and database password.
5. Review all user accounts with administrator access and remove any you do not recognise.

Troubleshooting

Redirects Persist After Cleaning

• Clear all caching layers, including your website cache, browser cache, and any content delivery network (CDN) cache.
• Check your domain's DNS settings for unauthorised changes to A records or CNAME records.
• Verify that your domain has not been hijacked at the registrar level.

Search Engine Warnings Appear

• Register your site with Google Search Console to review security issues and manual actions.
• Request a review once your site is clean to remove browser and search warnings.
• Submit your updated sitemap to help search engines reindex clean pages.

Host Has Suspended Your Account

• Your hosting provider may suspend accounts detected serving malware to protect other customers.
• Work with your provider to clean the site before requesting reactivation.
• Ensure all vulnerabilities are patched to prevent immediate reinfection.

Remember — If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?