304 North Cardinal St.
Dorchester Center, MA 02124
We received reports of a client website redirecting users to other pages as soon as they loaded it. The pages it redirected to were usually on the
Our server firewall didn’t report any issues. We replaced the WordPress source code (minus wp-content) but that didn’t help either. The infection had to either be in the database or inside the wp-content folder.
It wasn’t until we installed Sucuri’s WordPress plugin which detected an issue:
Our next stop was the
header.php file of the theme and there we found the two lines.
Always backup your website + database before making any changes.