I am using the Newsmag theme and it has been working fine till last April. Now some of the users observing my website are getting redirected to another website first time only. second on the word he can see the website.
Site Url – https://youthmukam.com/
Hi salty,
Indeed so it looks that is acting. Most of the time when this is happened is a code that has been injected in the WordPress.
My suggestion is to check those articles and clear the hack code and secure the website:
– WordPress Malware Redirect Hack – How To Fix Guide [2022]
– WordPress Hacked Redirect? How To Clean Website Redirect Malware
I hope this will help you!
HI Calin,
Thanks for the reply, I would like to add this website is redirecting only the first time if the user opens it mobile in a day and the second on word it opens correctly.
Hi salty, I saw this, even today when I accessed the link the first time I was redirected to this link -> xcebph.snowfalltwenty.top/ but those are redirections are not normal and a malware or a code injected can be programed how to affect the website.
Also, I suggest to ash your host for help too.
Thank you!
Thanks,
I had raised the complaint to the hosting provider as well and he is saying every thing is working fine on our end and he is not getting this issue.
I also said it is coming the first time only or between any time. He is saying to check the theme and plugins. may be this issue is coming from code only.
I don’t know what is solution. I have checked the theme file as well which you suggested in the last comment. still facing the same one.
In my opinion is not related to the theme, if it was, then all users that use the theme should had the problem.
I do not say that it is the host issue, I still believe that you have in some files some code injected that create this situation.
Please do a backup, after that please set a default theme and see if the problem persist or not.
Let us know the results!
I am having the same issue here, few hours after updating the theme
it is same as above described , first time redirect to another website, then load the website.
please help
Hi thilina36,
I recommend you do some investigations to see if your website does not has some malware or some injected code, usually, those are providing this kind of problem.
WordPress Hacked Redirect? How To Clean Website Redirect Malware
Thank you!
I have the same problem. I detected a suspicious javascript in wp_options where option name is td_010 and td_010_settings. Code is stored to tds_custom_javascript and tds_custom_html.
I disabled the output of tds_custom_javascript and tds_custom_html from td-composer plugin (file: legacy/common/wp_booster/td_wp_booster_functions.php). Code still appears in database after about 12 hours of removing it, someone adds code through api/ajax or something.
Suspicious javascript starts like this: eval(String.fromCharCode
Hi,
The td_010 is a theme table in the database that should hold the theme options. But that code should not do redirects or other things like this, can you please do some scans to check if you do not have some injections of code to do this action.
Thank you!
Hi, thanks for reply!
td_010 has tds_custom_javascript and tds_custom_html that will be outputted to theme footer (file: td_wp_booster_functions.php) and when removing that suspicious code from the database (eval(String.fromCharCode…), redirection will stop.
You can’t see the redirection url with naked eye, because it’s “hidden” by using fromCharCode.
I runned search with notepad++ to check any unwanted redirections.
Here is the javascript: https://pastebin.com/GyBezyat
And here is same code “unpacked”: https://pastebin.com/KKcNYHmR
That javascript creates a script element with external src which includes redirections.
Hi,
This is not from the theme, but, the database has been infected with weatherplllatform, there are many users with different themes infected with that malware – https://www.reddit.com/r/Wordpress/comments/xuxb3l/redirection_malware_is_killing_me_its_spread_to_4/
– https://www.myantispyware.com/2022/11/13/go-weatherplllatform-com-pop-up-redirect-virus-removal-guide/
By default, the themeforest package does not contain that code.
Thank you!
