Fix this week

Your address forwards visitors to a different website

What it means

A redirect tells the browser "this page lives somewhere else, go there instead". EverThread followed your address and ended up on a different domain that is not on your watch list.

There are plenty of innocent reasons: a move to a new domain, a booking system or online store hosted elsewhere, or a www and non-www version of your address where only one is on the list. There are also bad ones: a hacked site, changed settings, or a domain that expired or was taken over.

Why it matters

A redirect you did not set up hands your visitors to someone else. Hacked redirects usually lead to scam offers, fake prize pages or malware, and visitors blame the business they meant to visit.

Google may flag the site or drop it from results. And if the cause is your domain rather than your site, the same person could also receive email sent to your domain.

How to check your own site

1. Look at the destination in the alert. Is it a site you chose, such as your new domain, your booking system or your store? If so, skip to the FAQ on acknowledging it.
2. Open your address in a private or incognito window and note where you land. Then try it on a phone using mobile data, and by searching for your business on Google and clicking your result. Hacked redirects often fire only for mobile visitors, search visitors, or first-time visitors, so you may not see it every time.
3. To see each step, open your browser's developer tools (right-click, Inspect), go to the Network tab, tick "Preserve log", and load the page. Status codes 301, 302, 307 or 308 are redirects.
4. Sign in to your domain registrar, the company you pay for the domain. Check it has not expired and that the nameservers and contact email are the ones you expect.

How to fix it

Any website

1. If the redirect is intended, add the destination to the addresses EverThread watches, or acknowledge the finding, and we will stay quiet.
2. If not, back up the site as it is and change every password tied to it: site admin, hosting, domain registrar, DNS provider, and the email used for resets. Turn on two-step login wherever offered.
3. Find the redirect. It is usually a rule in the server settings (often .htaccess), a redirect plugin or app, a changed site address setting, a script on the page, or a DNS change.
4. Remove it, then find how it got in: an outdated plugin, theme or app, a reused password, or an old copy of the site on the same hosting.
5. If Google flagged the site, request a review in Search Console under Security & Manual Actions, Security issues, once it is clean.

Your domain registrar

1. If the domain expired, renew it right away. Registrars often allow a short grace period, but it will not last long.
2. Turn on auto-renew, two-step login and the transfer lock (sometimes called registrar lock).
3. Check that the nameservers and DNS records point where your developer or host expects. If they changed without you, contact the registrar's support team now.

WordPress

1. Under Settings, General, check that "WordPress Address" and "Site Address" are your own domain. If you cannot reach the admin, a developer can fix these in the database or in wp-config.php.
2. Check any redirect or SEO plugin for rules you did not create, and look in .htaccess for rewrite rules pointing to other domains.
3. Update WordPress, plugins and themes, delete unused ones, and reinstall the current version under Dashboard, Updates.

Shopify, Squarespace, Wix and other hosted builders

1. Check the built-in redirect tools: URL redirects on Shopify, URL Mappings on Squarespace, and the URL Redirect Manager on Wix. Menu locations change, so search the help center if needed.
2. Check custom code and installed apps for a script that sends visitors elsewhere, then check the Domains section for changes.
3. Change your password, turn on two-step verification, review staff accounts, and contact platform support if you did not make the change.

cPanel hosting

1. Open Redirects under Domains and remove any you did not create.
2. In File Manager, turn on "Show Hidden Files" in Settings and check .htaccess in your site folder for rules pointing to other domains. Sort by Last Modified to find other recent changes.
3. If your host runs your DNS, check the records in Zone Editor.

Cloudflare

1. Check Rules for Redirect Rules, Page Rules and Bulk Redirects you did not create, and check Workers for code that redirects.
2. Check DNS records, and review Members and the Audit Log for account changes you do not recognize.

What to send your developer

The check records the redirect chain of requests during a real page load and flags any hop from your host (or an allowlisted host) to a host outside the allowlist. That can be the page itself or a sub-resource served from your domain. Test with a mobile User-Agent and a search-engine Referer to catch conditional redirects, then check server rewrites, CMS settings, CDN rules and DNS.

curl -sIL https://example.com/ | grep -iE "^HTTP|^location"
curl -sIL -A "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X)" -e "https://www.google.com/" https://example.com/ | grep -iE "^HTTP|^location"
dig +short NS example.com
dig +short A example.com

Common questions