Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


A website of mine was recently the target of a conditional redirect attack.

  • PHP code was added to my pages to redirect visitors.
  • The .htaccess file was edited to redirect visitors.

I've re-uploaded my website so the compromised PHP and .htaccess code have both been removed.

My site is mostly handwritten php and static HTML content. I don't use page comments or any third party libraries.


After removing the compromised php and htaccess files, visitors are still being re-directed.

  • What could be the reason that visitors are still being redirected?
  • Are there any tools to check where/how redirects are taking place so I can debug the problem?


As suggested in the comments, I cleared my Firefox cache and that fixed the problem (for me anyway). Visitors with old cache data will obviously still be re-directed.

share|improve this question
Both "" and "" both appear to redirect to "poise.php" when I test with curl. Can you tell me how to reproduce the incorrect redirection? – Jerf Altair Jul 10 '12 at 4:34
possible duplicate of My server's been hacked EMERGENCY – mgorven Jul 10 '12 at 4:38
@mgorven: I don't believe my question is a duplicate. My question is asking about the existence of a specific tool to solve a specific problem. The question you link to is a general plea for help with a broad answer which doesn't answer my specific question. If you believe my question is a duplicate, please show me where my specific question is answered. – Shannon Jul 10 '12 at 5:57
@JeffHalter: Thanks for taking a look. Both "" and "" redirect to "poise.php" when the site is working correctly. The incorrect redirection can be reproduced here by right clicking the link above and choosing "open link in new tab". (Running Firefox, Windows 7 x64) I am also redirected incorrectly when following links from a google search. – Shannon Jul 10 '12 at 6:05
Have you tried clearing your browser cache? – Ignacio Vazquez-Abrams Jul 10 '12 at 6:11
up vote 1 down vote accepted

Try clearing your browser cache.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.