Wordpress Redirect Hack

Question

I have an issue with one of my websites running on the latest version of Wordpress.

When I'm in the back end and try to click a link to navigate to WooCommerce Orders, Pages, or settings for any of my plugins, I'm redirect to a random spam site.

The site loads at first but then is redirected to a page asking to accept cookies. This issue was happening on the home page until I disabled XML-RPC. Now it just seems to be affecting the back end when I try to go to the plugins, pages or any other section on the dashboard.

I'm sure there must have been some malicious code injected somewhere but I am tearing out my hair trying to find it. Has anyone experienced anything similar and could offer advice please?

Answer 1

Your site probably has some malware that is causing the redirects; a very common indicator of malware.

You will need to inspect and clean up the entire site. Lots of search results for that subject can be found.

Basics would be to inspect all files for obfuscated code (not just php files, but I've seen ICO files with malware), look for files that shouldn't be there, re-copy/reinstall all files (WP Core, plugins, themes) (not just update), look for unauthorized users (especially admin level), pages/posts that aren't supposed to be there, etc.

Cleanup can be done (I've done it for other sites), but will take hours for full inspection. And you have to monitor afterwards to make sure the site is not re-hacked.