A website of mine was recently the target of a conditional redirect attack.

  • PHP code was added to my pages to redirect visitors.
  • The .htaccess file was edited to redirect visitors.

I've re-uploaded my website so the compromised PHP and .htaccess code have both been removed.

My site is mostly handwritten php and static HTML content. I don't use page comments or any third party libraries.


After removing the compromised php and htaccess files, visitors are still being re-directed.

  • What could be the reason that visitors are still being redirected?
  • Are there any tools to check where/how redirects are taking place so I can debug the problem?


As suggested in the comments, I cleared my Firefox cache and that fixed the problem (for me anyway). Visitors with old cache data will obviously still be re-directed.

  • Both "www.onesmallclue.com" and "onesmallclue.com" both appear to redirect to "poise.php" when I test with curl. Can you tell me how to reproduce the incorrect redirection? Jul 10, 2012 at 4:34
  • possible duplicate of My server's been hacked EMERGENCY
    – mgorven
    Jul 10, 2012 at 4:38
  • @mgorven: I don't believe my question is a duplicate. My question is asking about the existence of a specific tool to solve a specific problem. The question you link to is a general plea for help with a broad answer which doesn't answer my specific question. If you believe my question is a duplicate, please show me where my specific question is answered. Jul 10, 2012 at 5:57
  • @JeffHalter: Thanks for taking a look. Both "www.onesmallclue.com" and "onesmallclue.com" redirect to "poise.php" when the site is working correctly. The incorrect redirection can be reproduced here by right clicking the link www.onesmallclue.com above and choosing "open link in new tab". (Running Firefox, Windows 7 x64) I am also redirected incorrectly when following links from a google search. Jul 10, 2012 at 6:05
  • Have you tried clearing your browser cache? Jul 10, 2012 at 6:11

1 Answer 1


Try clearing your browser cache.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.