Fix this week

Your page automatically sends visitors somewhere else

What it means

A meta refresh is a line in the page's code that looks like <meta http-equiv="refresh" content="0;url=https://example.com/">. The number is how many seconds to wait. The address after url= is where to go. With no address, the browser just reloads the same page on a timer.

It is an old technique. Common innocent uses are a "this page has moved" notice, a thank-you page that forwards after a few seconds, a page builder's redirect option, or a page that reloads itself every few minutes to show fresh information. Attackers use the same tag to send visitors to their own sites.

Why it matters

If you did not add it, someone else could change your page, and your visitors may be going somewhere you never chose. That is worth dealing with this week.

If you did add it, it still has downsides. Google handles it, but prefers a proper server redirect. A page that reloads or jumps on a timer can also confuse visitors, especially people using screen readers, and they may lose their place or what they were typing.

How to check your own site

1. View the page source (Ctrl+U, or Cmd+Option+U on a Mac) and search for refresh. Read the content value: the number of seconds and, if present, the destination address.
2. Ask whether that destination is yours or a service you chose. A destination on your own domain, such as a newer version of the same page, is almost always an old redirect someone set up.
3. If there is no address, the page simply reloads itself. That is usually a setting in a plugin, widget or template, not a hack.
4. Check whether the tag appears on every page or only this one. On every page, it lives in your template or site-wide code.

How to fix it

Any website

1. If it is yours and points to a page you want visitors on, replace it with a server-side 301 redirect from the old address to the new one, then remove the tag. Keep it only if your setup cannot do server redirects.
2. If it only reloads the page and you do not need that, remove it.
3. If you did not add it and the destination is not yours, treat the site as tampered with. Back up the site as it is, change the admin, hosting, FTP and database passwords, remove admin users you do not recognize, then remove the tag.
4. Find how it got in, usually an outdated plugin, theme or app, or a reused password, and update or remove it. The spam cleanup guide covers a full cleanup, including asking Google to recheck.
5. If you decide to keep the tag, acknowledge the finding in your EverThread dashboard.

WordPress

1. Check your SEO or redirect plugin for a redirect set on this page. Many can do a proper 301 instead, which is the better choice.
2. If the tag is on every page, check header.php in your theme and any plugin that inserts code into the header.
3. If you did not add it, update WordPress, plugins and themes, delete unused ones, and search your posts for http-equiv.

Shopify, Squarespace, Wix and other hosted builders

1. Use the built-in redirect tool instead of a tag: URL redirects on Shopify, URL Mappings on Squarespace, and the URL Redirect Manager on Wix. Menu locations change, so search the help center if needed.
2. Then remove the tag from the page's custom code, Code Injection or Custom Code settings.
3. If you did not add it, change your password, turn on two-step verification, review staff accounts and apps, and contact platform support.

cPanel hosting

1. Open Redirects under Domains, enter the old page and the new address, and choose "Permanent (301)". cPanel writes the rule for you.
2. Then remove the meta tag from the page. If you did not add it, check File Manager, sorted by Last Modified, for other recent changes.

Cloudflare

1. You can create a 301 under Rules, Redirect Rules instead of using a tag. Remove the tag from the page afterwards, and purge the cache under Caching, Configuration.

What to send your developer

The check reports any <meta http-equiv="refresh"> in the rendered DOM, with or without a URL. Replace intentional ones with an HTTP 301 (or 308) at the server, CDN or CMS. Google treats an instant meta refresh roughly like a permanent redirect and a delayed one like a temporary one, but recommends server-side redirects where possible. If it was injected, the tag may be added by script, so search templates, the database and inline scripts.

# Apache (.htaccess)
Redirect 301 /old-page https://example.com/new-page

# nginx
location = /old-page { return 301 https://example.com/new-page; }

Common questions