Malicious Redirects Exposed: Rebuilding Hearts of Oak's Digital Home

"An official website can look normal and still send visitors somewhere the organisation never approved." The warning was hidden inside the official website. During an internal technical audit of the existing Hearts of Oak website, Athmon Tech Firm found that some visits were being diverted away from official club content and towards unauthorised gambling and adult-content websites. For supporters, it was confusing and inappropriate. For the club, it meant its official digital front door could no longer be treated as dependable. That discovery became the defining decision of the rebuild. A surface repair might have hidden the symptom while preserving uncertainty underneath it. Hearts of Oak needed a website built from a clean, controlled foundation. We chose to create one. - The problem was bigger than a malicious redirect A redirect can look like one broken link. Unauthorised redirect behaviour across an official website points to a wider problem: the organisation cannot be certain that every part of the experience is acting as intended. The discovery surfaced through internal technical due diligence, the work a serious software team should complete before inheriting a legacy system. We reviewed the behaviour, considered what could safely be carried forward and assessed whether the old environment deserved to remain part of the new build. We did not claim an entry point we could not prove. The evidence was still sufficient for the decision that mattered: the legacy installation was not suitable as the foundation of the club's next website. - Why internal technical audits can no longer wait A website can appear healthy on its homepage while problems remain hidden in old code, third-party scripts, administrative access, forgotten integrations or behaviour that only affects certain visitors. What an organisation sees internally may not always be what the public receives. That is why internal technical audits are no longer optional housekeeping. They are a basic part of responsible software ownership. Institutions depend on their websites for reputation, communication, data, payments and public trust. Those systems should be inspected before a crisis makes the hidden problem visible. For Hearts of Oak, the audit did more than reveal malicious redirects. It gave the club and Athmon Tech Firm the evidence needed to reject a cosmetic repair and make a better engineering decision. - Why a repair would have preserved the wrong foundation A redesigned homepage could have made the old website look different without changing what sat beneath it. That would have produced a visual improvement while leaving the most important engineering questions unresolved. We therefore separated the replacement from the legacy codebase and built the website again. The new application would have a known structure, controlled source code, deliberate integrations and a traceable route from development to the live domain. This was not a reskin. It was a replacement. - Building the new website from the ground up Athmon Tech Firm designed and developed the new website using Next.js and React, with cloud delivery through AWS. The architecture separates the public site, authenticated supporter experiences, administrative functions, data services and payment flows so that each area can be managed deliberately. Amazon Cognito supports user authentication. Training bookings use DynamoDB. Media and streaming features connect through managed infrastructure, while payment flows integrate with Paystack. Sensitive service configuration is kept outside the public codebase. The development workflow also changed. Updates can be reviewed, tested and released from controlled source code instead of being applied as uncertain changes inside an ageing live website. - The result supporters can see The official Hearts of Oak website now brings news, team information, fixtures, results and academy content into one official digital home. It also supports membership, training bookings, community features, the club shop and HeartsTV. Verification of representative public pages confirmed that the official domain served the new Hearts of Oak experience without sending visitors to the unrelated third-party destinations observed during the legacy-site review. The visible result is a modern website built around the club. The deeper result is operational: Hearts of Oak now has a platform that can be maintained, extended and evaluated from a known foundation. - A platform built to keep moving A live digital platform is never frozen at launch. Club information changes, new supporter services are introduced and the systems behind the website require continued technical attention. Through the strategic technical sponsorship, Athmon Tech Firm continues to support the club's wider digital environment and the technical roadmap around it. The value of that relationship is demonstrated through the systems supporters and club teams can actually use. Some capabilities will continue to mature as the platform evolves. We consider that part of responsible software ownership, not a reason to exaggerate what has already been delivered. - The lesson for every institution Digital problems do not always announce themselves. Sometimes the homepage still loads, the branding remains visible and everyday operations continue. That apparent normality is exactly why organisations need regular internal technical audits of the systems that represent them and serve their users. Athmon Tech Firm found a website sending some visitors where they never intended to go. We refused to conceal that uncertainty beneath a new interface. We rebuilt the platform from controlled code and connected it to the services the club needed. That is the proof behind the work: a serious problem identified through disciplined review, a clear architectural choice made and a new website delivered for one of Ghana's most recognised football institutions. Malicious redirects were the warning. The rebuild was the response. The lasting lesson is simple: inspect what your users receive, not only what your organisation expects to see.