How to Fix a Malicious .htaccess Redirect Hack

A malicious .htaccess redirect hack adds hidden rules to your .htaccess file that send your visitors — or just some of them — to spam or scam sites. Because .htaccess is powerful and often overlooked, it is a favourite hiding place. The fix is to find the injected rules and remove them, then close the way in.

How it behaves

• Visitors get redirected to unfamiliar sites, sometimes only from search results or on mobile.
• The redirect is conditional, so it may not trigger when you visit directly — which is why it hides well.

Step 1: Back up and open .htaccess

Take a backup first. Then open File Manager, show hidden files, and open the .htaccess in your site's root. See editing your .htaccess file if you are new to it.

Step 2: Identify the malicious rules

Look for RewriteCond and RewriteRule lines that reference unfamiliar external domains, or conditions checking the referrer or user agent to redirect search or mobile traffic. Legitimate WordPress rules sit between clear # BEGIN WordPress and # END WordPress markers; injected rules often appear outside these, or look obfuscated.

Step 3: Restore a clean .htaccess

The safest fix is to replace the file with a clean, known-good version. For WordPress, you can reset it to the default rules (and regenerate them by saving Permalinks). Remove any malicious lines and save.

Step 4: Check other locations

Attackers may plant malicious .htaccess files in subfolders too, and the redirect is often re-added by a backdoor. Check subdirectories, remove backdoors, and look for related script injections.

Step 5: Secure and verify

Change your cPanel and FTP passwords, clear caches, and test — including from a search result and on mobile — to confirm the redirect is gone. Finish with the hardening checklist.

Frequently asked questions

The redirect only happens from Google, not when I type the URL.

The injected rule checks the referrer, so it targets search visitors and skips you. Test by clicking through from a search result to confirm the fix, not just by loading the site directly.

I cleaned .htaccess but it came back.

A backdoor is re-writing it. You must find and remove the backdoor and any malicious PHP, or the file will keep being re-infected.

Are there malicious .htaccess files in other folders?

Possibly. Attackers plant them in subdirectories too. Check your folders for unexpected .htaccess files, not just the root one.