Your website redirects visitors to spam or scam sites

What it means

Someone has placed hidden code on your website that sends some visitors elsewhere. It often only affects visitors coming from Google or on mobile, so you may not see it yourself when you open the site directly. This is a hack, and it tends to get worse, not better, if left alone. It can also get your site flagged by Google and browsers.

What usually causes it

• An outdated plugin or theme with a known security hole. Automated bots scan millions of sites for these.
• A “nulled” (pirated) theme or plugin that came with a backdoor.
• A weak or reused password on the website admin, hosting account or FTP.
• Another hacked site on the same hosting account, spreading to yours.

What you can check yourself (without making it worse)

1. Search Google for site:yourdomain.com and look for pages or titles you did not create.
2. Check Google Search Console, if you have it, under Security & Manual Actions.
3. Try your site on your phone using mobile data, and by clicking it from a Google search. Note when the redirect happens.
4. Change your passwords for the website admin, the hosting account and your email, and turn on two-factor login where you can. Do this from a clean computer.

Please do not just restore an old backup and move on. If the hole that let the attacker in is still open, they come back within days.

When to ask for help

• You confirmed a redirect or spam pages.
• Google or a browser shows a security warning for your site.
• Your host has suspended the site for malware.

Tell me what you saw and where your site is hosted. Cleanup means removing the hidden code, closing the hole that let it in, and asking Google to review the site. I will give you a fixed quote after the diagnosis.