Redirect issue, I'm getting a redirect on my page Options

[Peacedog]

I'm a average html designer, just designing as a side gig. I've used a template to design a site for a group. Each time you first visit the site, whatever link you click takes you to an unwanted site. It differs for who does it, but it's not related to the site. I've gone through the code and I can't find anything that's causing it. Any ideas on how to figure it out? I've checked my servers and computer for malware, but I find nothing. I've gotten complaints from visitors that it's happening to them too.

hillgrovehawks.com

Any ideas are welcomed.

Thanks

[Christian J]

Each time you first visit the site, whatever link you click takes you to an unwanted site.

Some server malware may add unwanted content on web pages only at a user's first visit (in order to avoid detection by the webmaster). If so, perhaps deleting cookies makes it reappear.

I didn't see anything myself , but I used a browser with restrictions in case it's malware.

It differs for who does it, but it's not related to the site.

Does it look like spammy links? I did notice some of the normal links seem to depend on javascript to function.

I've gone through the code and I can't find anything that's causing it. Any ideas on how to figure it out? I've checked my servers and computer for malware, but I find nothing.

You also use many external script files, containing who knows what...

It could also be malware in the browsers of each affected user, for example from a browser addon/extension/app. Are the affected persons random strangers, or do they have something in common that could explain all of them installing the same browser addon/extension/app (like being friends, relatives or collegues)?

[pandy]

I don't know how it's done. I can only confirm that it happens.

Somewhat interesting, I clicked Middle School that turns out not to be a clickable link when I revisit the page. The menu folds out when I hover Middle School. Nothing happens when I click it. Still the bad window spawns when I click the text, not when I hover it.

[pandy]

Some server malware may add unwanted content on web pages only at a user's first visit (in order to avoid detection by the webmaster). If so, perhaps deleting cookies makes it reappear.

Correct. It does.

[pandy]

I tried to check if it JS, but that didn't work. If I turn JS off I get a basically blank page. Well, it's red and there's a bird flapping, but that's it.

[pandy]

Ah! It isn't about links at all. It's enough to click anywhere on the page for the bad window to spawn.

So, I turned JS off again, deleted cookies, returned and clicked on the red page with the bird. Nothing happened. I guess that's expected. Something server side can't catch a click, I think. That doesn't mean it's only JS though.

Well, I'm afraid that's as far as I get. If I had the stamina I would comment out the scripts one by one and go to the page with cookies deleted and probably find the culprit, or at least part of it, that way. But that's too much work for me. But I suggest you do that. Then we can try to see what that script is up too.

I notice your page sets 4 cookies. At least 3 of them are counter related, judging from their names. Are you aware of them?

acceptcookiefreecounterstat
counter
counter_nv
acceptcookie

[Christian J]

Ah! It isn't about links at all. It's enough to click anywhere on the page for the bad window to spawn.

Can you see any click event in the browser's Inspector? It could be a transparent link covering the entire viewport.

If I had the stamina I would comment out the scripts one by one and go to the page with cookies deleted and probably find the culprit, or at least part of it, that way. But that's too much work for me. But I suggest you do that. Then we can try to see what that script is up too.

Note that a third-party script can be loaded by another script, and because of that is not visible in the HTML source when JS is disabled. It could also come from an external page in an iframe, the latter in turn created by some script (it could be a long chain of obfuscation).

But the origin of it all should be one of your own files, either a JS file or HTML file loading external content.

[pandy]

Ah! It isn't about links at all. It's enough to click anywhere on the page for the bad window to spawn.

Can you see any click event in the browser's Inspector? It could be a transparent link covering the entire viewport.

I don't know. Can you?

[Christian J]

I don't know. Can you?

Seems my Chrome-related browsers display Events Listeners in their Inspector, but not the Firefox-related ones.

Won't check myself.