The site has been hacked and is being redirected. In which direction to dig?

Question

PHP

When the page is opened, if pop-up windows are allowed, a transition (redirect) to an external site (more precisely, sites) is performed.
There is no frame in the html code.

Answer 1

Maybe in .htaccess file

Answer 2

Revert to the last good backup

Answer 3

Robots, revise site code for other links.

Answer 4

The thing is that the site on joomla was not made by me, they asked for help. I'm not familiar with joomla at all. Checking all the php files that are connected in one way or another is a disastrous business.

Answer 5

Search all files:
this is a search for the occurrence of badsite.ru in all .php files

Answer 6

Go to the root of the site on the server via SSH:
Edit the file, look for a vulnerability.

Answer 7

As an option: roll back to the latest working version, then check the site for vulnerabilities in one of the following ways: hdderror.ru/uyazvimosti/proverka-sajta-na-uyazvimo... and then close the vulnerability.