A visitor lands on a WordPress site and sees a familiar looking box: "Verify you are human." It looks a lot like the checks you see from Cloudflare and other security services, and it asks the visitor to press a couple of keys to prove they are real.

It is not real. It is WordPress malware living inside the website, and the site owner had no idea it was there.

We recently cleaned an infection exactly like this. It had spread across a group of sites that all shared one hosting account. Here is what it was, why nobody noticed, and what any owner can do to stay ahead of this kind of WordPress malware.

What the scam actually is

This family of attack is often called "ClickFix." The fake verification page only appears to visitors who are not logged in. It tries to talk the visitor into running a command on their own computer, usually by getting them to copy something and paste it into a system box.

Here is the one thing worth repeating to everyone you know: no legitimate verification check ever asks you to paste something into a Run box, a Terminal, or any system window. If a website ever tells you to do that, close the tab. Nothing good is on the other side of it.

The real target is your visitor, and your trusted website is just the delivery vehicle. That means the damage lands on the people who trust you, and on your reputation.

Why the owner never noticed

This is the part that surprises people. The infection was built to stay invisible to the one person most likely to catch it.

It hid from anyone logged in, so when the owner looked at the site, everything appeared perfectly normal. It also hid from search engine crawlers and from security scanners. And it forced the page to skip caching so it could keep serving the trick to fresh visitors.

The result was a site that looked completely healthy from the inside while quietly showing a scam to the outside world. The lesson underneath all of this is simple: "it looks fine to me" is not the same as "it is fine."

How one site became many

On shared hosting, several websites often run under a single account behind the scenes. A weakness in any one of them can let an attacker reach the files of every neighbor in that same account. That is how a single break turned into a whole group of infected sites at once. If you run more than one site on one plan, the health of each one depends on the health of all of them.

A look under the hood (for the curious)

If you like the technical detail, this WordPress malware had a few clever tricks.

It disguised itself as an ordinary plugin, with a normal sounding name plus a few random characters tacked onto the end, a fake author, and a believable description. At a glance in the plugin list it did not look out of place.

It also scheduled hidden background tasks to reinstall itself. That is why deleting the files alone did not make it stick. If you did not also remove the hidden tasks and close the way in, it simply came back.

The most striking part was how it found its instructions. Instead of calling home to a fixed web address, it looked up its marching orders from data stored on a public blockchain. That makes the usual defense of blocking the bad domain almost useless, because there is no single domain to block.

The way in was an unpatched vulnerability in a widely used plugin, which has since been fixed. Keeping that plugin current would have closed the door before any of this started.

How a cleanup like this actually works

Removing this kind of infection is less about deleting one file and more about closing a loop. In plain terms, the work is to find every hidden copy rather than just the obvious one, remove the malicious files along with the hidden tasks that reinstall them, and then close the door that let the attacker in by applying the security update and tightening access.

After that, you rotate the site's security keys so any stolen login sessions stop working, and then you watch. The real test of a cleanup is not the moment it looks clean. It is whether it stays clean over the following days.

How to check and protect your own site

You do not need to be a developer to stay ahead of most of this. A short routine goes a long way.

Keep everything updated. Keep WordPress, your plugins, and your themes current. The large majority of break ins use a known hole that a patch has already fixed.

Audit your plugins. Review your plugin list and remove anything you do not recognize, and be especially wary of a plugin with random looking letters on the end of its name.

Look at your site logged out. View it in a private browser window, and on your phone too, since some infections only reveal themselves to logged out visitors.

Monitor it. Use a monitoring or malware scanning service so you hear about trouble before your visitors do.

Lock down access. Restrict remote access to your database and review who can reach your hosting account.

Rotate after a compromise. Rotate your security keys and passwords rather than only deleting the files.

The takeaway

Modern WordPress malware is designed to be quiet. It hides from the owner, hides from scanners, and works hardest on the visitors who trust you most. A clean looking dashboard is reassuring, but it is not proof of a clean site.

If you would like a second set of eyes on your WordPress site, that is exactly the kind of work we do. Sitez helps businesses keep their online presence secure, current, and healthy, so you can spend your attention on your business instead of on what might be hiding in your site.