Any of the following can cause redirects:
.htaccess
files (cPanel usually edits one of these files)
- Apache configuration files (usually
httpd.conf
)
- In code (such as a plugin) that sets a
Location:
header.
- On the content delivery network (CDN), load balancer, or proxy server that sits between your application server and users
To locate the source of redirects, I usually search all the source code using recursive grep
on the command line. I usually search for the URL of the redirect.
URLs can be stored in the database as well (some WordPress plugins might do that), so it would be good to look there as well.
If it is malware that hacked your site and caused the redirect, the URL may be obfuscated in the source code to make finding it harder.
When testing redirects, you may also have to clear your browser's cache. If your site previously returned a redirect for a URL your browser is likely to remember that in cache and keep redirecting even after your site is fixed. This is especially true for 301 permanent redirects compared to 302 temporary redirects.