Sky Login redirect: removing the rogue redirect from WordPress

A 'Sky Login' plugin you never installed, and your site redirecting visitors? That's a redirect injection. Here's how to identify and remove it.

By WP-Detox 3 min read

You discover a plugin named “Sky Login” in your WordPress that you never installed — and your visitors are being redirected elsewhere, often without you seeing it yourself. That’s a redirect injection: a rogue component hijacking your site’s traffic. Here’s how to identify it and remove it completely.

What is the “Sky Login redirect”?

It’s a malicious component that presents itself as a plugin (often called “Sky Login” or something close) whose job is to redirect your visitors to a destination the attacker chose: spam, fake support, a scam, or a redirect chain. It appears after a break-in — via a compromised admin account or a vulnerable plugin — and monetises the stolen traffic.

Like many injectors, it applies cloaking: the redirect only fires for certain visitors (mobile, arriving from Google) and never for a logged-in admin. That’s why you can browse your own site normally while losing your visitors.

Symptoms

  • An unknown “Sky Login” (or similar) plugin in the plugins list.
  • Visitors reporting a redirect to a shady site that you can’t reproduce.
  • A redirect visible only on mobile, in private browsing, or from a Google result.
  • An admin account you didn’t create.
  • A Google “This site may be hacked” warning.

Where the redirect code hides

The fake plugin is rarely alone. The redirect is often duplicated:

  • in wp-content/plugins/sky-login/ (the fake plugin itself);
  • in a mu-plugin (wp-content/mu-plugins/), run automatically and invisible in the admin;
  • in the active theme’s functions.php;
  • in a database option (wp_options) storing the destination;
  • in the .htaccess file or at the top of index.php.

How to check if you’re infected

Over SSH:

ls -la wp-content/mu-plugins/
grep -rEl "wp_redirect|header\(.Location|window\.location" wp-content/ --include=*.php
grep -rn "sky.login\|skylogin" wp-content/ --include=*.php

Also check server-side redirects in .htaccess. The free WP-Detox scan detects cloaked redirects remotely, including those that only fire for Googlebot or mobile.

Removing it properly

  1. Back up the current state.
  2. Delete the fake plugin sky-login — but don’t stop there.
  3. Hunt for copies of the redirect in mu-plugins, the theme, .htaccess and database options, and remove them all.
  4. Delete the rogue admin account if there is one.
  5. Rotate every credential (admin, database, FTP, salt keys): the entry point must be closed, otherwise the redirect returns.
  6. If Google showed a warning, request a review once the site is clean — see removing Google’s “this site may be hacked” warning.

How it comes back (persistence)

As long as a single copy of the redirect remains — a forgotten mu-plugin, a line in functions.php, a database option — deleting the visible plugin changes nothing. And if the compromised account stays active, the attacker simply reinstalls the fake plugin. The cleanup is only real once every copy is removed and the entry point closed.

FAQ

I deactivated the Sky Login plugin but the redirect continues, why? Because the fake plugin is often just the visible part. The redirect code is frequently duplicated in a mu-plugin, the theme’s functions.php or a database option. Deactivating the plugin doesn’t remove those copies: you have to hunt the redirect everywhere.

The redirect only shows on mobile or from Google — is it the same problem? Yes. Redirect injectors often target mobile visitors or those arriving from a search engine, and spare the logged-in admin. That’s cloaking: the goal is to stay invisible to you while trapping your visitors.

Is it dangerous for my visitors? Yes. A rogue redirect sends your visitors to spam, scams or malicious pages, and can trigger a Google warning that blocks access to your site. Treat it as urgent.

At WP-Detox, we remove redirect injectors and their hidden copies, then close the entry point so they don’t come back. The scan is free, the cleanup takes about 30 minutes, it’s €149 excl. VAT and refunded if the site isn’t clean. For the big picture, start with the complete guide to cleaning a hacked WordPress.

Read next