Skip to main content
Threat playbook

Category: Deception & Impersonation

Malicious redirects

A malicious redirect sends you somewhere you did not pick. It often ends at a scam, fake login, or download.

Common causes are bad ads, hacked sites, and unwanted extensions. Close the tab without clicking anything. Remove extensions you do not recognize. Then check Chrome's pop-ups and redirects setting.

Each hop can change the final page. Attackers can show scanners a clean page instead.

Updated 2026-10-30

What causes malicious redirects?

Google's spam policies define sneaky redirects. They show users content they did not ask for. Hacked sites may carry injected redirect code. Some redirects fire only for certain referrers or devices.

Common redirect causes, signs, and fixes. Sources: Google, Chrome Help, and OWASP.
CauseWhat you seeFix
Malicious adsAn ad click lands on a scam or downloadClose the tab. See malvertising.
Hacked websiteA normal site jumps to spam or a scamLeave the site. Owners should check Search Console.
Unwanted extension or programRedirects on many sites, new tabs, a changed search engineRemove it, then reset Chrome settings. See malicious browser extensions.
Open redirect on a trusted siteA link starts on a real domain, then movesCheck the final address before you sign in
Allowed notificationsAlerts that open scam pagesBlock the site. See rogue browser notifications.

Common redirect causes, signs, and fixes. Sources: Google, Chrome Help, and OWASP.

How do you stop redirects in Chrome?

Chrome blocks pop-ups by default. These steps tighten redirect settings and remove common causes.

  1. Open Chrome and select More, then Settings.
  2. Choose Privacy and security, then Site settings.
  3. Open Pop-ups and redirects, then pick the blocking default.
  4. To block one site, find it under the allowed list. Select More, then Block.
  5. Still redirected everywhere? Remove unwanted programs and extensions.
  6. Then open Settings, then Reset settings. Choose Restore settings to their original defaults.
  7. On Android, tap More, then Settings, then Site settings. Open Pop-ups and redirects to block them.

How does a redirect chain work?

  1. You click a link or ad that hits a redirector.
  2. The browser bounces through several short-lived domains.
  3. The final page can change by referrer or device.
  4. Scanners may get a clean page instead.
  5. The chain ends at a fake login or download.

Why is my website redirecting to spam?

Unexpected redirects on your own site suggest a hack. Search Console's Security issues report flags hacked content and malware. Attackers may edit server files such as .htaccess. They also inject JavaScript redirects into pages.

  1. Open the Security issues report in Search Console.
  2. Check .htaccess and other server config files for redirects.
  3. Search templates and scripts for injected JavaScript.
  4. Fix the flaw that let the attacker in.
  5. Request a review once every issue is fixed.

What is an open redirect?

An open redirect lets a trusted domain forward you anywhere. OWASP says this makes phishing links look trustworthy. Site owners should not accept full destination URLs from users. Map short IDs to allowed destinations on the server instead.

Redirect chains often end at fake login pages.

Why do security tools miss redirect chains?

  • Some tools check the first hop without following the chain.
  • Cloaking shows scanners a different page than people see.
  • You see only the last page, not the hops.

Which redirect controls should IT teams use?

  • Log redirect chains that end at sign-ins or downloads.
  • Block notification prompts on unknown sites by policy.
  • Bookmark vendor portals instead of searching for them.
  • Keep admin consoles out of ad-driven browsing.
  • Fix open redirects on your own domains.

Where does browser isolation fit?

  • Isolation does not stop a site from redirecting.
  • Shield opens a page in an isolated browser off your device.
  • Shield destroys that browser when you close the tab.
  • Downloads still cross that boundary, so check every file.
Add to Chrome

Limits

  • Menu labels were checked on October 30, 2026.
  • Site-owner steps cover common cases, not every compromise.
  • This page cannot tell whether a given redirect is safe.
  • Legba publishes this guide. Shield is part of Legba's Chrome extension.

FAQs.

Are redirects always bad?
No, redirects are a normal part of the web. The risk is a chain that hides a malicious page.
Why does Chrome open new tabs with ads by itself?
An unwanted extension, program, or notification is usually behind it. Remove what you do not recognize. Then reset Chrome settings.
Can a browser extension cause redirects?
Yes, unwanted extensions are a common cause. Google lists redirects among the signs of unwanted software. Remove unfamiliar extensions first.
How do I fix a hacked site that redirects visitors?
Start with the Security issues report in Search Console. Remove injected code and bad server rules. Fix the entry point, then request a review.
How can IT detect malicious redirects?
Look for long hop counts and newly registered domains. Flag chains that end at sign-ins or downloads.
Does browser isolation stop redirects?
No, sites still redirect inside an isolated browser. Isolation changes where the pages run.

References

  1. 01
    Google Search Central: Spam policies for Google web searchGoogle
  2. 02
    Search Console Help: Security issues reportGoogle
  3. 03
    OWASP Cheat Sheet Series: Unvalidated Redirects and ForwardsOWASP
  4. 04
    Google Chrome Help: Block or allow pop-ups in ChromeGoogle
  5. 05
    Google Chrome Help: Remove unwanted ads, pop-ups & malwareGoogle

Keep exploring

Try it on the next page you do not trust

Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device.

Add to Chrome

Free for 30 days. No card required.

Ghost. A private route for your browser. Shield. An isolated browser, off your device. Choose the mode. Close when finished.