Skip to content
MP MD Pabel WordPress security

WordPress Malware Research Entry

ushort.company Meta-Refresh and JavaScript Redirect in post_content

A WordPress post redirects immediately when opened? See database evidence of a zero-delay meta refresh paired with JavaScript navigation.

Reviewed: July 22, 2026
Artifact class Database-stored dual redirect
Evidence confidence High
Risk assessment High

Start with the problem you are seeing

Could this match the problem on your WordPress site?

This investigation is directly relevant when opening a particular post or page immediately sends visitors elsewhere. The retained database content contained both a zero-delay meta refresh and JavaScript navigation to the same destination.

Observed in this investigation

  • The affected post_content record contained two immediate navigation mechanisms pointing to the same external destination.

Possible warning signs

  • Opening the affected content can send a visitor away before the legitimate page is readable.
  • The redirect may remain after theme files are replaced because the markup is stored in the database.

These signs are investigation leads, not proof of this artifact by themselves.

Questions this research can help answer

  • Why does one WordPress post redirect immediately to another website?
  • Can a malicious redirect be stored in post_content instead of theme files?

Evidence boundary: The stored redirect is confirmed; the evidence does not establish who inserted it or how access was obtained.

Seeing one of these signs on your site?

I can investigate the files, database records, users, and server evidence, explain what is confirmed, and help plan a safe cleanup.

Ask me to investigate your site See how my malware cleanup works

Research focus: Forensic analysis of a database record containing both meta-refresh and window.location redirects to the same defanged endpoint.

Summary

This WordPress malware research entry documents database-stored dual redirect evidence observed during one anonymized client investigation. The narrow topic is ushort.company Meta-Refresh and JavaScript Redirect in post_content: the page records the exact artifact, identifiers, and visible control flow instead of repeating a general malware-removal article.

The duplicate redirect methods increase the chance that a browser follows the external destination. The evidence does not show the destination response or which visitors encountered the record.

Investigation context

Anonymized investigation with three database screenshots and a supplied redirect excerpt; one directly relevant privacy-safe image is published. The report date is retained from the original investigation notes. Broader cleanup guidance remains in the WordPress malware removal guide; this entry is limited to what the supplied code and screenshots support.

Observed artifact

Both redirect mechanisms were stored in a WordPress content record.

WordPress post_content field containing meta-refresh and window.location redirect code
The expanded post_content field shows two immediate redirects to ushort[.]company. The adjacent records and table prefix do not establish the injection source.

Confirmed findings

  • A post_content field contains meta http-equiv=refresh with a zero-second delay.
  • The same field assigns window.location.href.
  • Both methods point to the same ushort[.]company path.

Technical analysis

Why two redirect mechanisms appear in one record

The following code keeps the identifiers and control flow needed for defensive verification while removing secrets, complete payloads, and operational request instructions.

Redacted defensive excerpt

<meta
  http-equiv="refresh"
  content="0; url=hxxps://ushort[.]company/[redacted]"
/>
<script>
  window.location.href = "hxxps://ushort[.]company/[redacted]";
</script>

This excerpt is intentionally incomplete. It should be used for code search, baseline comparison, and incident review—not copied into a live site.

Analyst assessment

The duplicate redirect methods increase the chance that a browser follows the external destination. The evidence does not show the destination response or which visitors encountered the record.

The severity reflects the capability visible in this artifact and its position in the investigated WordPress environment. It is not a claim about campaign prevalence, a particular vulnerability, or an outcome that the retained evidence does not show.

Indicators of compromise

Higher-confidence indicators

  • ushort[.]company endpoint
  • Meta refresh and window.location.href in the same post_content field

Contextual indicators

  • post_content
  • meta refresh
  • window.location.href
  • Database search match count

Contextual indicators are not proof of infection by themselves. Confirm them through trusted-file comparison, neighboring code, database provenance, request logs, or the distinctive combinations listed above.

What this evidence does not establish

  • The options-table screenshot is excluded because it exposes identifiable client information.
  • The evidence does not establish how many rows were affected.
  • The initial database write path and remote destination behavior were not retained.
  • No vulnerable component or affected version was confirmed.

Artifact-specific remediation

  • Export affected records before editing.
  • Remove the confirmed redirect block and inspect revisions or duplicated rows.
  • Search the full database for the defanged domain and both code forms.
  • Review logs and privileged activity for the write source.

For a complete response sequence, use the broader malware-removal guide or the WordPress malware-removal service when hands-on incident response is appropriate.

Recurrence verification

  • Repeat the database search after page saves and scheduled tasks.
  • Verify rendered pages and feeds no longer redirect.
  • Monitor the affected record for unauthorized changes.

Browse the WordPress malware research hub.

Methodology and privacy note

This analysis is based on retained code, screenshots, paths, and notes from an anonymized WordPress client investigation. Confirmed findings are limited to visible or supplied evidence; professional interpretation is labeled as analyst assessment. Screenshots were reviewed for client identifiers, account paths, usernames, email addresses, credentials, tokens, database details, and unrelated records. Sensitive or operational material remains outside the public page, and every public code block is a redacted defensive excerpt.