Moatline

WordPress fake CAPTCHA malware (ClickFix): how to find and remove it

A fake “verify you are human” box that asks visitors to press Windows + R and paste a command is not a glitch. Your site has been hacked to infect your visitors. Here is where the code hides and how to remove it.

By the Moatline team at Next Nova Technologies · Published 14 October 2026 · Updated 15 October 2026 · 6 min read

What the WordPress fake CAPTCHA (ClickFix) is

ClickFix is a trick that turns a hacked website against its own visitors. Code injected into your WordPress site shows a page that looks like a Google reCAPTCHA or a Cloudflare check. After a fake “verification failed” message, it tells the visitor to:

  1. Press Windows + R
  2. Press Ctrl + V
  3. Press Enter

The page has already copied a command to their clipboard. Running it downloads password-stealing malware onto the visitor's computer. Security researchers have reported thousands of WordPress sites carrying fake CAPTCHA code, and new campaigns keep appearing: Sucuri tracked one across more than 5,000 sites, and Rapid7 found another on hundreds of business and news sites in 2026.

We remove this infection from client sites regularly. What makes it hard to clean is not the pop-up itself but everything that puts it back.

How to check if your WordPress site has it

  • Visit while logged out. Use a private window, ideally on a Windows computer, and also try your phone on mobile data. The script usually skips logged-in admins.
  • Come in from Google. Search for your site and click the result. Some scripts only show the box to search visitors.
  • View the page source (Ctrl + U) and search for clipboard, mshta, powershell, atob(, eval(, web3 or bsc-dataseed. These are rare on a normal small-business site.
  • Check Google Search Console under Security & Manual Actions → Security issues, and look up your site in Google Safe Browsing.
  • Run a scan that checks the database as well as files. The free Moatline Malware Scanner has a dedicated check for fake CAPTCHA and ClickFix code in files, posts, widgets and Elementor data.

Where ClickFix code hides in WordPress

In the cleanups we've done, the code that shows the fake CAPTCHA was found in one or more of these places, often several at once:

  • The theme's functions.php, as a block of code that adds a script to every page.
  • Theme or plugin JavaScript files, with the loader appended to the end of a legitimate minified file.
  • Posts, pages, widgets and Elementor data in the database. No file is changed, so file-only scanners report the site as clean.
  • Fake plugins with random or official-sounding names, such as “wordpress-security”, “wordpress-defender” or a random five-letter folder. Many hide themselves from the Plugins page, so they only show up in File Manager.
  • wp-content/mu-plugins, which load automatically and don't appear in the normal plugin list.
  • PHP files in wp-content/uploads that act as a backdoor and can restore everything else on demand.
  • Options and scheduled tasks in the database that store an encoded copy of the malware and reinstall it after you delete it.

For a real example, see how we found a fake CAPTCHA hidden in a WooCommerce store’s database.

Many current variants don't contain a suspicious web address at all. They read the next stage from a DNS record or a blockchain smart contract, so the code looks like an ordinary script that loads a “library”. If a small business site talks to a cryptocurrency network, treat it as malware.

How to remove the fake CAPTCHA malware, step by step

  1. Back up the infected site (files and database) before changing anything, so you keep the evidence and can roll back a mistake.
  2. Change your hosting, email and WordPress admin passwords from a clean computer. If attackers still have a password, they will simply put the code back.
  3. Scan files and the database. List every infected file, fake plugin, injected post and suspicious database option before you delete anything.
  4. Remove fake and hidden plugins. Compare wp-content/plugins and wp-content/mu-plugins in File Manager with the Plugins page. Delete any folder you didn't install.
  5. Replace infected core, theme and plugin files with fresh copies from the official source instead of editing them by hand. For the theme's functions.php, compare it with a clean copy and remove the injected block.
  6. Delete PHP files from uploads. WordPress never needs them there.
  7. Clean the database: injected scripts in posts, revisions, widgets and Elementor data, unknown options holding encoded code, scheduled tasks you don't recognise, and admin users you didn't create.
  8. Log everyone out and regenerate the security keys in wp-config.php, so stolen login cookies stop working.
  9. Scan again the next day and three days later. If anything comes back, a backdoor is still in place.

For the full process, see our step-by-step guide to removing malware from WordPress. Moatline Pro can remove injected code in one click and blocks malicious scripts from being saved into posts and page-builder content again.

After the cleanup: lock the door and clear the Google warning

  • Find the way in. Check your access logs for a login followed by a plugin upload, update every plugin and theme, and remove nulled or unused ones.
  • Turn on two-step login for every administrator and block PHP in the uploads folder. Moatline's free Lockdown and two-step login do both.
  • Request a review in Google Search Console under Security issues once the site is clean. Warnings are usually removed within a few days.
  • Check your other sites on the same hosting account. One infected site can reinfect the others.

If a visitor ran the command

If someone tells you they followed the steps in the fake CAPTCHA, their computer may be infected with password-stealing malware. Advise them to disconnect it from the internet, run a full antivirus scan, and then change their important passwords (email, banking, work accounts) from a different, clean device, turning on two-step login where they can.

Frequently asked questions

Why don't I see the fake CAPTCHA when I visit my own site?
Most ClickFix scripts skip logged-in WordPress users, and many show the box only once per visitor, only on Windows, or only to people arriving from Google. Check in a private window, while logged out, on a Windows computer, or from your phone on mobile data.
Is the fake CAPTCHA dangerous to my website or to my visitors?
Mostly to your visitors. The command they are tricked into running installs password-stealing malware on their own computer. For your site, it usually leads to a Google “dangerous site” warning, lost traffic and, sometimes, a suspended hosting account.
I deleted the script but the fake CAPTCHA came back. Why?
The visible script is only the last step. A hidden plugin, a must-use plugin, a file in uploads or a scheduled task in the database puts it back. Scan files and the database, remove every backdoor, then change all passwords and security keys.
Can a security plugin or firewall alone remove ClickFix malware?
Not always. Many scanners check files only, but ClickFix code is often stored in posts, widgets or page-builder data in the database, or loaded from a blockchain contract with no suspicious URL to block. Use a scanner that checks the database and content too.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →