If a WordPress site starts sending visitors to spam, pharmacy, or scam URLs — sometimes only on mobile, sometimes only once — it is often redirect malware. A quick delete of one suspicious file can look like a win. Then the redirect returns a week later.
## Why “one file” cleanups fail
Redirect malware rarely lives in a single place. Common leftovers include:
– Backdoors in `wp-content/uploads` or mu-plugins
– Injected code in `header.php` / `footer.php` or a child theme
– Database spam in `wp_options`, widgets, or post content
– Cron jobs or unknown admin users that reintroduce the payload
If those stay, reinfection is not mysterious. It is unfinished work.
## A calmer investigation order
1. Capture the redirect URL and which devices or paths trigger it.
2. Inventory admins, plugins, and recently modified files.
3. Search the database for the redirect domain fragments.
4. Remove identified malware and backdoors carefully.
5. Harden access (passwords, keys, unused plugins) and document what changed.
## Honest limits
Cleanup reduces risk. It is **not** a permanent reinfection warranty. Ongoing updates and access hygiene still matter.
If you are dealing with redirects on a live store or agency client site, describe the URL and symptoms and I will reply with next steps.