Sign up ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I don't really know how to express my problem, so bear with me. This is a bit hard to explain.

I have a Wordpress installation, the latest, and often (once a day) my site redirects users to the /wp-admin/install.php file. Asking for my login credentials of course. I have tried reinstalling WordPress and still have not been able to figure what they are doing.

That happens regularly. Also, a few hours later, I am able to see my site normally. Hope this makes sense.

I suspect there myst be some database DoS that allows them to inject a redirect of some sort into my admin area, thus redirecting the user to said directory (install.php). But that's just me. I really have no clue what else could they be doing.

I looked at the source code from several php files and noted some of them don't include a ?> tag. Could that be an issue?

My hosting company is iPage, I've contacted them and they say there's nothing wrong with my files. Anyone have a clue? I can paste the code to any source file.

share|improve this question
Did you attempt to upgrade WordPress or plugins prior to noticing this behavior? – JCL1178 Mar 26 '14 at 1:38
This behavior has been around for months. Since it's a new domain, I didn't noticed that was happening until weeks later. At this point I don't know if that happened prior to any Wordpress updates. But I believe so, because I only noticed it weeks later, the site would go "down" for a couple hours and then came back by itself. I just wasn't aware. – saul Mar 26 '14 at 3:22
Have you seen this question? There are some answers there that sound like they would be worth checking. (And if they do solve your problem, feel free to come back here and answer your own question with the solution – it might be helpful to others in the future.) – Nick Mar 26 '14 at 9:24
Does the redirect occur only when going to the admin login page, or when accessing any page in the public part of the site as well? – nathangiesbrecht Mar 26 '14 at 15:52
It's really hard to say what's going on. I basically uploaded a blank htaccess file to my Admin folder and installed Wordfence Security plugin. Although the site has been running "without" problems for the past few days. One day, while I was logged into the dashboard, the site again redirected me to the install.php. It used to happen several times a day, so I'm sure either the htaccess file of the plugin have had some effect. We'll see how it behaves the next few days. – saul Mar 31 '14 at 3:00

4 Answers 4

I would upload a fresh copy of WordPress excluding the wp-content folder. Update the core files. Then check your htaccess is correct. It's likely the installation didn't complete. Does iPage have any server side caching which you can manually clear?

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress
share|improve this answer

Hi to be honest to the best of my knowledge the most common WP hacks are either weak PW security that has been compromised and allowed malicious code / updates to be made (consider the number of WP admins that didnt change the default UN 'wp-admin' thats already half of the auth guessed). Or for historic installs / ones with the offending versions bad versions of PHP thumb of (that used to have a well knowen exploit).

If your site is redirecting at all it would indicate that it has been compromised already and depending upon the method you are using to update it the malicious files (or DB entries) might not be getting touched / deleted.

However there are a bunch of 'remedies' on good old Google but also as with most things WP there are a bunch of plugins that can detect for common compromises. If you can still access your manager it may well be worth trying one of these as a starter..

Good luck!

share|improve this answer
Thanks, I installed and scanned using gotmls. It did found some vulnerabilities, but they go beyond the scope of my expertise. I was specially suspicious about these files: .../tumblr/wp-includes/js/json2.js .../tumblr/wp-includes/js/jquery/jquery.schedule.js .../tumblr/wp-includes/js/swfupload/swfupload.js But then I have another domain and these same files were included as potential threats too. – saul Mar 26 '14 at 4:57
Hi also dont forget that if someone does manage to get write access to you web files they can update existing scripts that appear legit. As an after thought if you have been compromised other people will almost certainly have been too. Next time your site is redirecting get the URL it redirects too and try googling "wordpress redirects to domain" and see if you get some suggestions like that maybe? Again good luck. – megasteve4 Mar 26 '14 at 10:39
Also to whoever down voted my answer - fair enough if you disagree with what I am saying but then maybe take the time to explain why and share you views for the benefit of others rather than just blindly down voting. – megasteve4 Mar 26 '14 at 10:41
Just went into my logs stats file. I found a log that seems suspicious. I don't fully understand the structure but apparently it calls for a GET function on wp-admin/install.php, which is where the redirect is happening. Here's the link to that GitHub: Any thoughts highly appreciated. – saul May 27 '14 at 20:43
Are you parsing RSS Feeds? – eyoung100 May 28 '14 at 22:37

There's no accepted answer, but it's over a year old, so I'm answering for the sake of academia.

If you're checked the database structure, and you've replaced the core files, there's really only one answer that remains: your host. There is obviously some communication issues between Apache and MySQL (assuming this is what your host uses).

share|improve this answer

This is a year old, but I saw it so I might as well try to answer it as there is no accepted answer (yet).

The most common reason for this is caused by changing your database. For example, my host's database server was down for some time and when it was up again, I had to 'install' it again. In this case, this is expected behavior.

If this is not the reason, there's probably some issue with the installation. For example, it failed but you can't see it.

A bit off-topic, but I would also highly recommend not to use iPage -- even if there were no files I think they'd still say 'nothing is wrong'.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.