Why does the redirect only happen on mobile?

The payload inspects the user agent and fires only for mobile devices, because mobile users are less likely to inspect the URL bar and site owners usually test on desktop.

The redirect stopped after one visit. Is it gone?

Probably not. Most payloads set a cookie so each visitor is redirected once. Test again in a private window with cookies cleared.

Can a redirect come from an ad or analytics script?

Yes. If the first request to the redirect domain is initiated by a third-party script, your own files are clean and the fix is to remove or replace that script and notify its provider.

Website Malwareintermediatethreat profile

Malicious Redirects

Conditional redirects send your mobile or search visitors to scam pages while the site looks normal to you. How they are implemented and how to trace them.

Cyber Security Space editorial desk · Published 25 Jun 2026 · Updated 22 Aug 2026 · 2 min read · Reviewed 22 Aug 2026

Short answer

A malicious redirect is injected code on a compromised website that sends visitors to an attacker-controlled destination, usually only under specific conditions such as arriving from search results, using a mobile device, or visiting for the first time, which is why the site appears normal to its owner.

Key takeaways

Redirects are conditional by design: reproduce them with a mobile user agent, a search referrer and no cookies before concluding the site is clean.
Injection points fall into four buckets: server config, PHP includes, database content, and third-party JavaScript.
A redirect chain often passes through several hops; capture the full chain rather than just the final URL.
Redirects delivered by a compromised third-party script are fixed at the script provider, not in your own files.

Where do malicious redirects live?

Location	Typical form	How to check
Server configuration	.htaccess or nginx rules keyed on user agent or referrer	Review config files and compare against version control
Application code	A header() call in an include loaded on every request	Diff core, theme and plugin files against official releases
Database content	Injected script tags in post content or site options	Search stored content for script tags and unfamiliar domains
Third-party script	A compromised or hijacked analytics, ad or widget script	Watch the network waterfall for the first request to the redirect domain

How do you reproduce a redirect you cannot see?

STEP 01
Use a clean session
Open a private window, or clear cookies. Many redirect payloads fire once per visitor and then set a suppression cookie.
STEP 02
Emulate a mobile device
Switch to a mobile user agent in devtools. Mobile-only redirects are the most common variant.
STEP 03
Arrive from search
Set a search engine referrer, or click through from a search result, since many payloads check the referrer.
STEP 04
Capture the full chain
Record every hop with response codes and the initiator of each request. The initiator tells you which file or script triggered it.

curl -sIL -A "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X)" \
  -e "https://www.google.com/" https://example.com/ | grep -Ei "^(HTTP|location)"

How do you remove a malicious redirect?

Identify the initiator from the captured chain before editing files.
Restore the affected config or code file from a known-good copy.
Clean injected script tags from the database, including cached fragments.
Remove or pin third-party scripts you do not control; add Subresource Integrity where the provider supports it.
Purge caches and CDN, then re-test with the same mobile and referrer conditions.
Rotate credentials and check for backdoors and scheduled tasks.

What damage do malicious redirects cause?

The visible cost is lost traffic and conversions. The larger costs are a browser-level Deceptive Site warning, removal from search listings, and the reputational damage of customers landing on scam pages carrying your brand. Because the redirect is conditional, this can continue for weeks before anyone internally reproduces it.

Frequently asked questions

Why does the redirect only happen on mobile?: The payload inspects the user agent and fires only for mobile devices, because mobile users are less likely to inspect the URL bar and site owners usually test on desktop.
The redirect stopped after one visit. Is it gone?: Probably not. Most payloads set a cookie so each visitor is redirected once. Test again in a private window with cookies cleared.
Can a redirect come from an ad or analytics script?: Yes. If the first request to the redirect domain is initiated by a third-party script, your own files are clean and the fix is to remove or replace that script and notify its provider.

Sources

Fixing hacked sites: unwanted redirects — Google Search CentralSupports: Conditional redirect behaviour and cleanup expectations.
Subresource Integrity — MDN Web DocsSupports: Limiting risk from third-party scripts.