Site hacked, please help!

You need to start working your way through these resources:

• https://codex.www.ads-software.com/FAQ_My_site_was_hacked
• https://www.ads-software.com/support/topic/268083#post-1065779
• https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
• https://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:

• https://sitecheck.sucuri.net/scanner/
• https://www.unmaskparasites.com/
• https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

I’m afraid that your site is infected with bogus jquery malware:

https://sitecheck.sucuri.net/results/3moonscoffee.com

There’s a blog article about this malware here:

https://blog.sucuri.net/2015/11/jquery-min-php-malware-affects-thousands-of-websites.html

It’s almost always hidden in the theme header.php files so you should be able to remove it from there (that article has the code posted so you can recognize it when you see it) and that should remove the redirects.

Just removing the header.php injection probably won’t suffice though as there are probably some backdoors uploaded to the website so the attackers can maintain access.

Also, this malware is notorious for very aggressive cross contamination, so if you have any other websites hosted in the same account (subdomains, etc) then they are likely pwned as well ??