ClickFix Fake CAPTCHA Attacks on WordPress: How to Spot, Clean and Prevent Them
A fake “I’m not a robot” box that asks you to press Windows + R and paste a command is never real. This ClickFix trick has spread across thousands of hacked WordPress sites. Here’s how it works — for visitors and for site owners.
What’s in this guide
What Is ClickFix?
ClickFix is a social-engineering attack that shows visitors a fake CAPTCHA or Cloudflare-style “Verify you are human” check. After a few fake steps, the page claims there’s an error and tells the visitor to press Windows + R (or open Terminal on a Mac), paste, and press Enter.
The page has already copied a malicious command to the clipboard. Running it downloads malware — usually an infostealer that grabs passwords, cookies and crypto wallets. New Zealand’s NCSC warned in September 2026 that campaigns often compromise WordPress sites to host these pages.
A real CAPTCHA will never ask you to run a command on your computer.
Warning Signs for Visitors
- A “Verify you are human” page that asks you to press keyboard shortcuts or paste anything.
- A fake browser update or “DNS fix” prompt.
- A full-screen overlay that appears a few seconds after a normal page loads.
- Instructions to open PowerShell, Run or Terminal.
Where the Malicious Code Hides in WordPress
Security firm Sucuri found that infections typically hide in several places at once — and many hide themselves from the WordPress dashboard:
| Location | What to look for |
|---|---|
| wp-content/plugins | Folders with random five-character names, or names like wp-word-word that you didn’t install |
| Hidden .htaccess files | Base64-encoded code in an assets folder, or a misspelled .htacces file containing a backdoor |
| Theme functions.php | Injected JavaScript added to your active theme |
| Fake “analytics” plugins | Plugins with plausible names (one variant called itself “PixelPerfect Analytics”) |
Because these plugins hide from the plugin list, check the server files directly via SFTP or your host’s file manager.
Malicious content may only appear to real visitors — crawlers and scanners can see a clean page. Test your site from a private window, a different network and both mobile and desktop.
How to Clean an Infected Site
- Take a backup of the current files and database for investigation, then put the site in maintenance mode.
- Change every password: WordPress admins, hosting/cPanel, SFTP and the database. Remove unknown admin users.
- Remove suspicious plugin folders directly on the server and reinstall legitimate plugins and themes from official sources.
- Clean theme files, especially functions.php, or replace the theme with a fresh copy.
- Hunt for backdoors — look for odd .htaccess/.htacces files and PHP files using eval or base64. Backdoors let attackers return even after the visible malware is gone.
- Scan again with a security plugin or an external scanner, and request a review if Google Safe Browsing flagged your site.
- Warn your visitors if they may have been exposed, and tell them not to run any copied commands.
If you’re not comfortable editing server files, take the site offline and get help from your host or a professional cleanup service.
How to Prevent It
MFA everywhere
Turn on two-factor authentication for wp-admin and your hosting account.
Update & trim
Keep core, plugins and themes updated; delete anything unused.
Lock the editor
Add define(‘DISALLOW_FILE_EDIT’, true); to wp-config.php.
Monitor files
Use file-integrity monitoring and a web application firewall.
Also give users the minimum role they need — most writers don’t need Administrator access.
FAQ
What is a ClickFix attack?
A fake CAPTCHA or error page that tricks visitors into pasting and running a malicious command, which installs malware.
Can a real CAPTCHA ask me to press Windows + R?
Never. Any verification that asks you to run a command is a scam.
Why don’t I see the malicious plugin in my dashboard?
Many ClickFix plugins hide themselves from the WordPress plugin list. Check the wp-content/plugins folder on the server directly.
How do I stop it from coming back?
Remove backdoors, change all passwords, enable MFA, update everything and add file monitoring and a firewall.
Related Reading on FutureLume
ClickFix works because it looks like a routine security check. Visitors should never run commands a website asks for, and WordPress owners should check their server files directly, remove hidden backdoors and lock down admin access with MFA.
Sources: NCSC New Zealand · Sucuri
