Troubleshooting guide
Visitors see suspicious redirects: A Practical Diagnostic Path
Visitors see suspicious redirects can have several causes that look identical from the outside. Use this path to gather useful evidence without making the original problem harder to reproduce.
Record the symptom before changing it
Capture the exact screen, user role, time, device, and sequence that produces the issue. Note whether search engines or browsers show warnings occurs at the same time.
- Save exact error text
- Record the last known working date
- List recent code, content, vendor, DNS, or account changes
Separate reachability, data, and behavior
First confirm whether the affected system can be reached. Then confirm the expected record or content exists. Only then test the behavior supported by website and WordPress incident response.
- Reachability check for backup validation and restoration
- Data or content check related to compromised website triage and cleanup
- Behavior check for malware, redirect, and unauthorized-user investigation
Use stop conditions
Stop and preserve evidence if a test could overwrite data, invalidate logs, lock out users, or remove the only working copy. Recovery work needs a known restore path before intrusive changes.
- No confirmed backup
- Unknown production ownership
- Security or payment data may be involved
Verify the repair in the real journey
A green technical check is not enough. Repeat the original journey, test a nearby edge case, and confirm the result from the perspective of organizations facing malware, redirects, blacklisting, weak access, or missing backups.
- Compromised website triage and cleanup
- Backup review and controlled restoration
- Dependency and permissions hardening