Compromised sites sometimes trick visitors into allowing browser notifications. Even after the website is cleaned, users who subscribed may continue receiving spam notifications from the attacker’s push domain.
Symptoms
- Visitors are aggressively prompted to click Allow for notifications.
- After allowing, the browser receives spam, scam or adult/gambling notifications.
- The prompt is injected before the real site content.
- Previously affected users continue seeing notifications after website cleanup.
Indicators of compromise
These indicators help investigation but should be interpreted in context. A single item does not automatically prove compromise.
How this threat persists
The website infection can enroll visitors into a third-party push service controlled by the attacker. Cleaning WordPress stops new enrollments, but existing browser permissions may also need to be revoked by affected users.
Investigation and recovery
- Remove the injected notification script and any malicious service worker.
- Identify the WordPress source of the injection.
- Review third-party tag managers and legitimate push integrations for compromise.
- Revoke suspicious browser notification permissions on affected test devices.
- Close the original entry point and monitor for reinjection.
WP•FIX treats security incidents as root-cause investigations. The goal is not only to remove the visible payload, but also to identify the persistence mechanism and the access path that allowed the compromise.
Prevention after cleanup
Prevention depends on the actual entry point. Common controls include verified software sources, prompt patching of vulnerable components, credential rotation after compromise, least-privilege administrator access, clean backups, file-change monitoring and review of hosting/CDN/security logs.
FAQ
Why do notifications continue after the website is clean?
Browser notification permission can persist independently of the website files until the user revokes it.
Is every “Allow notifications” prompt malicious?
No. Legitimate sites use push notifications, but deceptive prompts and unfamiliar domains should be investigated.
Can the infection be in Google Tag Manager?
A compromised or unauthorized tag can inject scripts, so tag-manager access and container history may be relevant.
Do I need to notify visitors?
That is a business/legal decision based on what occurred and what data or devices may have been affected. Preserve evidence before making claims.
Seeing signs of Malicious Push Notification Redirects?
Send the site URL and the exact behavior you or visitors see. Include screenshots or warning text when available.
Open a security incident