When a site redirects to an unknown address, this is almost always a break-in rather than a settings mistake. The technique is designed so the owner does not notice. The redirect only fires for visitors arriving from search, only on phones, or only once per visitor. You open the site directly and it looks normal.
Open the site on a phone over mobile data and through a search result rather than by typing the address. Try a private window as well. If the redirect only happens in those situations, that confirms deliberate hiding.
Change the passwords for hosting, the file connection, the database and the WordPress administrators. Remove any users you do not recognise. Skip this and the attacker still has access, and restores the redirect the moment you remove it.
The usual hiding places are the .htaccess file, the theme start-up files, a directory disguised as a plugin and settings rows in the database. Look in the media library directories too, because executable code is commonly left there among the images. If you do not know what you are looking for, do not guess, move on to step 5.
After a break-in a site is often left with an extra administrator and a scheduled task that restores the malicious code. If the redirect returns a few hours after you removed it, this is exactly what is happening.
Removing one redirect does not make a site clean. The full clean-up is covered in our guide on a hacked website. A clean backup is the fastest way back if you have one from before the break-in, see our guide on backing up a site.
Once the redirect is gone, search results can still carry a warning for days. Removing it requires a separate request, covered in our guide on Google warning about your site.
Do not settle for removing the redirect and moving on with your day. The back door remains, and next time the site is used for something more visible. Do not update first and investigate later either, because updating wipes the traces that would have told you the cause.
We clean the site completely, close the route that was used to get in and tell you what was done while they were there. We do not just remove the redirect, because it comes back within days.
