Desktop testing looks normal, but a customer tapping a search result on a phone reaches gambling or adult content. Malware and compromised advertising often segment visitors by mobile user agent, screen size, country, referrer and cookie history.
Do not dismiss the report because the administrator’s desktop cannot reproduce it.
Capture the mobile conditions
Record the legitimate URL, destination domain, time, device/browser, country and how the visitor arrived. Ask whether it occurred on the first visit and whether Back returned to the site.
A screenshot or screen recording is useful. Do not ask the visitor to revisit the destination.
Preserve a text copy of the destination URL without opening it on a normal device.
Test safely with real and emulated mobile
Use an isolated mobile device or disposable browser profile. Browser device emulation changes viewport and user agent but may not reproduce cellular network, browser storage or regional targeting.
Test:
- mobile data and Wi-Fi where authorised;
- direct and search-referrer entry;
- first visit with clean storage;
- affected URL and homepage;
- mobile user agent from a desktop analysis environment.
Do not log into WordPress during these tests.
Locate the redirect stage
Record a network log. Determine whether the initial response is a server redirect, clean HTML that later runs injected JavaScript, or an iframe/advertisement navigation.
Check for scripts testing navigator.userAgent, viewport width, referrer, language or cookie values. Preserve the surrounding code in an offline evidence copy.
Do not paste obfuscated script into a public beautifier. It may execute or disclose private paths.
Compare cache variants
A CDN or mobile-cache feature may store a poisoned response for one device class or region. Inspect cache status and response body from the affected route.
Bypass the CDN only through an authorised origin test. If the origin is clean but one edge response is infected, preserve headers and purge that object after confirming no malicious source remains.
Do not purge first and investigate later when evidence of selective caching would otherwise be lost.
Review ads and third-party tags
Malvertising can redirect only certain mobile visitors while WordPress files remain unchanged. Inventory advertising, tag-manager, pop-under, chat and consent scripts.
Disable one optional integration in staging and repeat the trigger. Review account users and publish history for external tag platforms.
Even when a third party delivered the redirect, check WordPress for compromise. Attackers may have inserted the tag or changed its identifier.
Inspect site and account persistence
Review recently changed PHP/JavaScript, theme files, plugins, database content, scheduled tasks, users and hosting configuration. Search for the destination domain and loader URL.
Check .htaccess, server redirects, DNS and neighbouring sites under the same account. Rotate credentials only after preserving needed evidence and ensure compromised devices are addressed.
Removing one script is incomplete if an unknown administrator or stolen panel session can restore it.
Verify across the targeting matrix
After cleanup, repeat mobile, first-visit, referrer and regional tests. Confirm normal status/HTML, no external navigation and no suspicious storage or service worker.
Monitor outbound domains, redirect reports and file changes. Ask the original reporter to confirm only after your controlled tests are clean; do not make them the primary tester.
Check both portrait and landscape orientation if viewport width formed part of the targeting rule.
When urgent cleanup is needed
Selective mobile redirects warrant urgent assessment because most administrators will not see them. Send the public page, time and screenshot without passwords.
A credible repair explains the targeting condition, loader, account entry or third-party source, persistence controls and evidence that the same mobile journey is now clean.