ClickFix-style fake CAPTCHA pages imitate browser or Google-style verification and instruct visitors to perform unsafe actions, often copying or running attacker-controlled commands. On a WordPress site, the visible overlay may be injected by compromised JavaScript, database content, a malicious plugin/theme or an external script loader.
Symptoms
- Visitors see an unexpected “Verify you are human” or fake reCAPTCHA-style screen.
- The page instructs users to press keyboard shortcuts, paste commands or run something outside the browser.
- The behavior appears only for new visitors, mobile traffic or specific referrers.
- Security products or Google may flag the site because the page participates in malware delivery.
Indicators of compromise
These indicators help investigation but should be interpreted in context. A single item does not automatically prove compromise.
How this threat persists
The WordPress compromise is the mechanism that injects or loads the fake verification experience; the social-engineering flow then targets the visitor. Removing only the overlay is insufficient if the loader, backdoor or vulnerable entry point remains.
Investigation and recovery
- Preserve evidence and identify where the injected script is loaded.
- Remove malicious JavaScript, database payloads and persistence mechanisms.
- Replace modified WordPress/plugin/theme files with verified clean versions where appropriate.
- Review administrators, credentials, scheduled tasks and external script integrations.
- Close the entry point and recheck the site from clean sessions/devices.
WP•FIX treats security incidents as root-cause investigations. The goal is not only to remove the visible payload, but also to identify the persistence mechanism and the access path that allowed the compromise.
Prevention after cleanup
Prevention depends on the actual entry point. Common controls include verified software sources, prompt patching of vulnerable components, credential rotation after compromise, least-privilege administrator access, clean backups, file-change monitoring and review of hosting/CDN/security logs.
FAQ
Is a fake Google CAPTCHA actually from Google?
No. Attackers copy familiar CAPTCHA branding and layouts. A legitimate Google reCAPTCHA should not instruct a visitor to paste commands into the operating system.
Why do I not see the fake CAPTCHA as the administrator?
Malware often uses cookies, referrers, device type or one-time conditions to avoid showing the payload to site owners.
Can clearing WordPress cache remove it?
It may change what you see, but cache clearing does not remove the malicious loader or root cause.
What should visitors do if they followed the instructions?
They should stop interacting with the page and have the affected device reviewed with appropriate endpoint-security guidance; the website owner should separately investigate the WordPress compromise.
Seeing signs of ClickFix Fake CAPTCHA Attack?
Send the site URL and the exact behavior you or visitors see. Include screenshots or warning text when available.
Open a security incident