If my website is redirecting to another site, how do I fix it? That question usually arrives with a jolt of panic. You type in your own domain, and instead of your homepage you land on a spammy pharmacy page, a fake giveaway, or some site you have never seen before. Take a breath. This is a common problem, it has known causes, and it is fixable.
In this guide I will walk you through why it happens, how to find the redirect, how to remove it step by step, and how to keep your site clean afterward. No jargon, just the same process I would follow on any small business site.
Why your website is redirecting to another site
A redirect is just an instruction that says "send visitors somewhere else." Redirects are a normal, healthy part of the web when you set them up on purpose (moving a page, for example, uses a 301 redirect). The trouble starts when someone else adds one without your permission, or when a well-meaning setting goes wrong.
The most common causes, roughly in order of likelihood:
- Malware or a hacked site. An attacker slipped code into your site that bounces visitors to their site. This is the classic "malicious redirect."
- A compromised plugin or theme. Especially on WordPress, an outdated or pirated plugin is the usual door the attacker walked through.
- Hijacked DNS or domain settings. Someone got into your registrar or hosting account and pointed your domain elsewhere. (If DNS is a fuzzy concept, my plain-English guide to what DNS is will help.)
- A rogue ad or script. A third-party ad network or an old tracking script you pasted in years ago can inject redirects.
- An honest mistake. A redirect plugin rule, an expired domain forwarding setting, or a botched site migration can send people to the wrong place with no hacker involved.
First, figure out what kind of redirect you have
Before you fix anything, spend five minutes narrowing down the cause. The symptoms tell you a lot.
| What you see | Most likely cause |
|---|---|
| Redirects only sometimes, or only on phones | Malware (attackers often target mobile visitors or every few visits to avoid detection) |
| Redirects only from Google search results, not when you type the address | Malware targeting search traffic, or hacked search listings |
| Every visit redirects, from everywhere, instantly | DNS or domain settings changed, or a site-wide redirect rule |
| Redirects only on one page or one link | A single infected page, plugin rule, or bad link |
| Browser shows a security warning first | Expired or broken SSL plus a redirect problem (see my guide to SSL certificates and HTTPS) |
Two quick tests that help: open your site in a private or incognito window, and check it on a device that has never visited your site before. If your regular browser behaves but a fresh one redirects, malware is very likely.
How to fix a website that redirects to another site, step by step
Step 1: Lock down your accounts
Change the passwords on your hosting account, your domain registrar, and your website admin login. Turn on two-factor authentication wherever it is offered. If an attacker still has a key to the front door, cleanup is pointless because they will just walk back in.
Step 2: Check your DNS and domain settings
Log in to your registrar and confirm your domain still points to your hosting. Look for nameserver changes, new DNS records you did not create, and any "domain forwarding" setting switched on. If your domain itself was hijacked, contact your registrar immediately, this is their territory and they deal with it often.
Step 3: Look for redirect rules and injected code
If DNS looks clean, the redirect lives in your site. The usual hiding spots:
- The .htaccess file (on most WordPress and PHP hosts). Malicious redirects often appear here as strange rewrite rules pointing to an unfamiliar domain.
- Core files like index.php or wp-config.php. Look for long scrambled strings of code (often labeled base64) that were not there before.
- Theme files, especially header.php and functions.php. Injected JavaScript here runs on every page.
- The database. On WordPress, check that your site URL settings still show your own domain, and look for unfamiliar admin users.
- Redirect and plugin settings. Open any redirect plugin you use and scan the rules list.
If this feels over your head, that is a completely reasonable place to draw the line. A malware cleanup service or your host's support team can handle it, and getting it fully clean matters more than doing it yourself.
Step 4: Remove the malware, or restore a clean backup
You have two paths. You can clean the infection by removing the injected code and deleting anything you do not recognize, or you can restore a backup from before the problem started. Restoring is often faster and more thorough, as long as the backup predates the infection and you fix the entry point afterward. If you have never set up backups, this is the moment that convinces most people. My guide on how to back up your website covers how to do it properly.
Step 5: Close the door the attacker used
Cleaning without patching means reinfection, usually within days. Update your platform, themes, and plugins. Delete any plugin or theme you are not actively using. Remove old admin accounts. If you suspect the breach went deeper than a redirect, my post on what to do when your website is hacked walks through the full recovery process.
Step 6: Repair your standing with Google
If Google flagged your site ("This site may be hacked" or a red warning screen), open Google Search Console, check the Security Issues report, and request a review once you are confident the site is clean. Then keep an eye on your pages for a few weeks. If rankings dipped during the infection, they generally recover once Google re-crawls the clean site. My guide to fixing crawl errors in Search Console shows you where to look.
Tip: After cleanup, clear every cache you have: your site's caching plugin, your host's server cache, and any CDN. A cached copy of the infected page can keep redirecting visitors even after the site itself is clean, which makes you think the fix failed when it actually worked.
How to keep it from happening again
Malicious redirects are almost always a symptom of neglected maintenance rather than a sophisticated attack. A few habits close off most of the risk:
- Update your platform and plugins promptly, or turn on automatic updates.
- Use strong, unique passwords and two-factor authentication on hosting, registrar, and admin accounts.
- Keep automatic backups running and occasionally confirm they restore correctly.
- Remove plugins, themes, and user accounts you no longer need.
- Put your site on a regular checkup schedule. My website maintenance checklist makes this a fifteen-minute monthly routine.
For a broader look at protecting your site, from firewalls to login hardening, see my guide to website security for small business.
Frequently asked questions
Why does my website redirect only on mobile phones?
Attackers often write redirects that fire only for mobile visitors, or only for people arriving from Google. It makes the infection harder for the site owner to notice, since owners usually check their own site on a desktop by typing the address directly. If your site behaves on your computer but redirects on a phone, treat it as malware and follow the cleanup steps above.
Will a malicious redirect hurt my Google rankings?
It can, if it lingers. Google may add a warning label to your listing or temporarily drop infected pages, and visitors who get bounced to a spam site lose trust fast. The good news is that rankings usually recover after you clean the site, request a review in Search Console, and Google re-crawls your pages. Speed matters more than anything, so fix it as soon as you notice.
Can I just delete the redirect code and be done?
Deleting the visible redirect removes the symptom, not the cause. Attackers almost always leave behind a hidden backdoor file so they can reinfect you later. A real fix means removing the injected code, updating everything, changing passwords, deleting unfamiliar files and users, and ideally running a malware scan afterward. If any of that is beyond your comfort level, hand it to a professional and keep the receipt of exactly what they cleaned.