How to Remove Malicious Redirect Hacks in WordPress (Malaysia)

Malicious redirect hacks are incredibly sneaky. They often target only mobile users or visitors coming from Google Search, redirecting them to scam sites while the admin sees a perfectly normal website.

Detecting Conditional JavaScript Redirects

Hackers inject conditional JavaScript into your theme's header.php or footer.php. This script checks the user agent or referrer.

Check your current theme's header via SSH:

cat wp-content/themes/your-active-theme/header.php

Look for obfuscated JavaScript tags just before the </head> tag, often utilizing String.fromCharCode to hide the destination URL.

Securing wp-config.php

If your wp-config.php permissions are too loose, malware will inject payloads directly into the configuration.

Run a quick audit of your file permissions:

stat -c "%a %n" wp-config.php

It should ideally be 440 or 400, never 644 or 777. If compromised, replace the WordPress core salts and ensure no strange include() statements exist at the top of the file.

Database Payload Scans

Redirects can also be stored in the wp_options table, specifically in the siteurl or home rows, or within active widgets.

Using WP-CLI, verify your core URLs:

wp option get siteurl
wp option get home

If they have been altered to a rogue domain, change them back immediately.

---

Need Expert Help?

Stop losing traffic to malicious redirects. JagaWeb has secured digital assets for leading brands like Daralwahi. Get our RM5,000 Ownership & Access Review to surgically remove the malware, or subscribe to our RM450/month Care Plan for continuous protection. Contact us today.