Website Keeps Redirecting to Another Site?

A customer tells you that your website sent them to a strange page. You try it yourself and everything looks normal. This is one of the most confusing website problems, because the redirect often depends on who is visiting and how they arrived. Work through the checks below in order.

Cause 1: The site was hacked

Attackers who get into a site often add a redirect that sends visitors to scam pages, fake prize offers or pill sellers. Google calls this a sneaky redirect and treats it as spam. The common signs:

• The redirect happens on phones but not on computers.
• It happens only when people click your site in Google results, not when they type the address.
• It happens once per visitor, so when you try again, you see your normal site.
• Google shows "This site may be hacked" under your listing, or Search Console reports a security issue.

These tricks are on purpose: they keep the owner from noticing. Google's guide on web.dev to sites hacked with malware describes attackers changing server configuration files, such as .htaccess, so that only visitors coming from a search engine are sent away.

Cause 2: A domain problem

• The domain expired. When a registration lapses, the registrar often replaces your site with a parking page full of ads, and after a while someone else can buy the name. Check the expiry date in your registrar account today.
• Domain forwarding is switched on. Registrars offer a "forwarding" setting that sends every visitor to another address. It may be left over from an old website or a promotion.
• DNS points to the wrong place. After a move or a change of supplier, a DNS record may still point at an old server that now redirects somewhere else.

Cause 3: A setting on your own site

• Wrong site address. In WordPress, Settings > General holds the site address. If it was changed to another domain, every page jumps there.
• A forgotten redirect rule in a plugin, in .htaccess, or in a CDN or host dashboard, perhaps from a past redesign.
• Redirect loops. Two rules that send visitors back and forth end in "too many redirects". This often follows an HTTPS change; see our Not secure guide.

One more honest possibility: if only one person sees the redirect on every site they visit, the problem is likely an unwanted browser extension or adware on their device, not your website.

How to check what is happening

1. Test like a stranger. Use a phone on mobile data, in a private window, and click your site from a Google search for your business name. Then type the address directly. Note which one redirects.
2. Trace the redirect. On a computer, press F12, open the Network tab, tick Preserve log and load the page. Each redirect shows as a 301, 302 or 307 line with the next address. A tool such as curl -I shows the same from the command line.
3. Check the registrar. Look at the expiry date, forwarding settings and DNS records.
4. Check Google Search Console. Open Security issues and Manual actions, and use URL Inspection to see your page as Google sees it.
5. Look at the server files. Ask your host, or check .htaccess and similar files for rules that mention other domains or test for search engines or phones.

How to fix it

• Domain problem: renew the domain, turn on auto-renew, remove unwanted forwarding and correct the DNS records.
• Setting problem: correct the site address, remove the old rule, and test again on a phone and a computer.
• Hack: treat it as a full clean-up, not only a deleted line. Back up, change every password, clean or restore, update all software and ask Google for a review. Our guide to what to do when a website is hacked lists the steps in order.

How to prevent it

• Keep the CMS, theme and plugins updated, and delete what you do not use.
• Use unique passwords and two-factor login for hosting, registrar and site admin.
• Turn on auto-renew and registrar lock for your domain.
• If your site has a feature that sends visitors to an address taken from a link, only allow your own pages. Spammers abuse these "open redirects".
• Verify your site in Search Console so Google can email you about security issues.