Your site redirects visitors to foreign pages - what to do

Customers report landing on gambling or spam pages. You open the site yourself and everything looks normal. That is not a false alarm - it is how this works.

The .htaccess file - normal, and a popular target

A .htaccess file in the Joomla main directory is nothing unusual. Joomla ships a prepared file called htaccess.txt that, in Joomla’s own words, contains instructions to avoid common exploits and to implement search-engine-friendly URLs; the usual step is to rename it to .htaccess. Two things follow from that. First, the manual explicitly says not to edit htaccess.txt, because a Joomla update can overwrite it - work happens in the renamed file. Second, Sucuri documented a Joomla case in 2019 in which the malicious script was built to write its redirect pattern into every .htaccess file it could find. One cleaned file therefore does not mean the site is clean.

Where this kind of code hides

Sucuri names the typical places in its Joomla clean-up guide: back doors injected into files such as index.php and into directories like /components, /modules and /templates, and files that carry the name of a genuine Joomla file but sit in the wrong directory. In the Joomla case from April 2026 the code sat at the very top of the site’s index.php. There is also malware that installs itself as an ordinary Joomla plugin and injects obfuscated JavaScript into the page - Sucuri lists it as php.spam-seo.joomla-injector.002. Two consequences for you: a plugin you do not recognise deserves a hard look, and template files can be inspected right in the back end under System›Site Templates without FTP or a command line.

One thing that is usually harmless

Joomla has a redirect feature of its own in the core: the System - Redirect plugin collects missing pages and the Redirects component points them at existing ones. Entries there are part of normal operation. Finding redirects in that component is therefore not evidence of an attack.

Replacing core files - and what that does not cover

Joomla can replace its own core files without a command line. The update component carries a button labelled Reinstall Joomla! core files, described as reinstalling all core files to repair broken or missing ones. Know the limit before you rely on it: the wording covers the core files only. Extensions, templates, files placed on the server on top and the database are not included - a back door sitting in a template or a plugin would survive this untouched.

Sources & further reading

• Joomla manual - the .htaccess filehtaccess.txt is a template, do not edit it
• Sucuri - .htaccess injector on Joomla and WordPress siteswritten to every .htaccess it finds
• Sucuri - How to Fix, Clean & Secure a Hacked Joomla! Sitetypical hiding places for back doors
• Sucuri Labs - php.spam-seo.joomla-injector.002malware that installs itself as a plugin
• Joomla manual - managing 404 errorsthe built-in Redirects component
• Sucuri - Joomla SEO spam injector (April 2026)code at the very top of index.php
• Google - Fixing the Japanese keyword hackon cloaking and the URL Inspection tool

Υπερισχύουν πάντα τα επίσημα στοιχεία του εκάστοτε κατασκευαστή. Η σελίδα αυτή συνοψίζει ουδέτερα τις δημόσια διαθέσιμες πληροφορίες.