How to Remove Malicious JavaScript Injections and Redirects

A JavaScript injection is malicious code added to your pages that runs in your visitors' browsers — redirecting them to scam sites, showing unwanted pop-ups, or worse. Because it often triggers only under certain conditions (a mobile device, a search-engine referrer), it can be maddening to pin down. Here is how to find and remove it.

How it shows up

• Visitors are redirected to unfamiliar sites, sometimes only on mobile.
• Unexpected pop-ups or ads appear that you never added.
• Browser or antivirus warnings flag your site.

Step 1: Secure access and back up

Change your cPanel, admin, database and FTP passwords, and take a full backup before editing.

Step 2: Find the injected script

The malicious JavaScript can live in several places:

• Theme and template files — look for unfamiliar <script> tags or long, obfuscated strings.
• The database — injected into content, widgets or settings; see removing malware from the database.
• JavaScript files themselves, appended to legitimate code.
• Header/footer injection settings in your CMS.

A malware scan speeds up locating it. Viewing your page source and spotting scripts calling unknown domains is a useful manual check.

Step 3: Remove it and replace clean files

Delete the injected scripts. Where the code is added to legitimate files, replace those files with clean official copies rather than editing around the malware. Remove any backdoor that could re-inject it.

Step 4: Clear caches and verify

Clear your caches (and any CDN cache) so the clean version is served, then test on desktop and mobile, and from a search-engine click, since some redirects only trigger that way.

Frequently asked questions

The redirect only happens on mobile or from Google.

That is deliberate — the injection checks the device or referrer so it evades the owner testing on desktop. Always test on mobile and via a search result to confirm it is gone.

I removed the script but it came back.

A backdoor or a database injection is re-adding it. Remove the underlying malicious files and database content and every backdoor, not just the visible script.

Is my visitors' data at risk?

Malicious JavaScript can attempt to capture input or redirect to phishing, so treat it seriously. Clean promptly, and if login or payment pages were affected, advise users and reset credentials.