What the heck is going on with my site?!!

URL please.

https://www.capitalescorts.ca

Thanks!

it shows a bunch of random sites loading and then the user gets redirected to some random spam site.

How do I get it fixed without having to stop using the plugins, or is it not plugin related?

You’re almost certainly hacked. Your plugins and WordPress install is suspect.

Try this: in Chrome load up your blog. Once it starts loading, right click on the web page and select View Page Source (or View -> Developer -> View Source from the menu).

Now while viewing the source, CTRL-F (or command-F on the Mac) and search for IFRAME. Look around line 40’ish, see anything goofy?

If you do, read up on these.

Give these a read (links courtesy of Esmi).

https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

https://codex.www.ads-software.com/Hardening_WordPress

After you’ve read through that, you want to take a backup of everything and put it somewhere safe.

https://codex.www.ads-software.com/WordPress_Backups
https://codex.www.ads-software.com/Backing_Up_Your_Database
https://codex.www.ads-software.com/Restoring_Your_Database_From_Backup

Once you’ve cleaned up and are satisfied, make another fresh backup as well of the clean blog. The backup is your friend and should be respected. It will put you right where you were incase the Really Bad Thing(tm) happens.

Laughter, I took too long replying and you provided a URL. It’s on line 42 and it’s not an IFRAME, it’s an img src.

Hi Jan,

Thank you so much for your help and advice.

So the cause of the trouble is from an img src code that someone hacked my site to put in? It’s strange because this spam never happened to me before.

There is a 1px x 1px iframe on line 122 also.

So the cause of the trouble is from an img src code that someone hacked my site to put in? It’s strange because this spam never happened to me before.

Once you’re hacked it’s pretty simple to hide/bury the compromised code. You’ll need to see if it was caused by the TimThumb hack and if you’re still vulnerable or if it was something else.

Don’t forget to also look at your .htaccess file.

Edit: Oh, and when the site does come up, it’s NSFW’ish. The Google cache still has the old copy.