How to Fix Hacked WordPress Site Redirecting to Scam & Casino Ads: Step-by-Step Emergency Manual Cleanup Guide (2026)

If visitors to your WordPress website are being hijacked and sent to illicit casino, gambling, or fake tech-support scam pages, your site has been hit by the infamous WordPress Malware Redirect Hack. Hackers write sneaky conditional logic so site owners logged into the admin dashboard don't notice the redirect, while real mobile visitors or Googlebot get hijacked.

01. Understanding the Conditional Redirect Hack

The redirect payload is hidden behind User-Agent or Referrer checks. The malicious script evaluates whether the request comes from a search engine crawler (Googlebot, Bingbot) or a mobile device, and suppresses the payload if it detects an admin IP or logged-in WordPress session cookie.

To fix this permanently, you cannot simply clear browser cache or install a basic free security plugin. You must execute a complete, step-by-step manual server cleanup to purge every backdoor web shell.

02. Step 1: Emergency Server Isolation & SSH Backup

Connect to your web server via SSH or SFTP. Before modifying or deleting any files, create a full compressed backup of your site directory and MySQL database.

03. Step 2: Locating Obfuscated Code & Web Shell Backdoors

Hackers inject base64-encoded strings and obfuscated PHP functions like eval(), gzinflate(), str_rot13(), and assert() deep into theme files, plugin folders, or rogue core files (e.g. wp-tmp.php, index.php.bak).

Run the following Linux grep commands in SSH from your web root to locate hidden backdoor web shells:

04. Step 3: Surgical Cleaning of .htaccess & wp-config.php

The redirect hack often overrides your web server's .htaccess file with rewrite rules targeting malicious external C2 domain endpoints or proxy scripts.

Inspect .htaccess and replace its content with the default clean WordPress .htaccess setup:

Next, inspect wp-config.php. Hackers often insert an @include line at the very top of wp-config.php pointing to a hidden file in /tmp or /wp-includes/. Delete any suspicious require/include lines that precede <?php or define('DB_NAME'...).

05. Step 4: Database Audit & SQL Injected Payload Removal

Often, the malicious redirect JavaScript script tag is stored inside the database in wp_options (specifically siteurl, home, or active widgets) or inside wp_posts.

06. Step 5: Core Reinstallation & Uploads Execution Lock

Never try to selectively edit core files. Replace all core files from an official, fresh WordPress distribution:

1. Delete /wp-admin/ and /wp-includes/ completely.
2. Download fresh WordPress zip from WordPress.org and upload clean /wp-admin/ and /wp-includes/ folders.
3. Delete all original files in root except wp-config.php, .htaccess, and wp-content directory.
4. Block PHP script execution inside /wp-content/uploads/ by creating a .htaccess file inside uploads/ containing:

07. Step 6: Google Search Console Blacklist Removal

Once the malware payloads, web shell backdoors, and database entries are completely cleaned, log into Google Search Console.

• Navigate to Security & Manual Actions → Security Issues.
• Click Request Review.
• Detail the exact remediation steps taken: core files replaced, database cleaned, PHP uploads execution disabled, and passwords reset.
• Google typically reviews and removes the warning flag within 12 to 24 hours.