WordPress problem fix
Real Cloudflare checks never ask anyone to open Run or PowerShell and paste a command. If yours does, your site is being used to infect your visitors.
A fake Cloudflare or CAPTCHA page that tells visitors to press keys, open the Windows Run box or PowerShell, and paste something is a known attack called ClickFix. Attackers inject a script into a hacked website, usually WordPress, and the pasted command installs password stealing malware on the visitor's computer. Security researchers have tracked thousands of infected WordPress sites, and government agencies in Australia and New Zealand have issued warnings. The script often hides from logged in admins, search engines and security scanners, so the owner is usually the last to see it. The fix is a full cleanup: find the injected script in the theme files or database, find how the attacker got in, remove every way they can return, then change all passwords.
If any of these match, you are on the right page.
Visitors see a Cloudflare style "Verify you are human" box you did not set up
The box asks people to press Windows and R, or open PowerShell or Terminal, and paste
Customers say your site gave them a virus or their accounts were stolen
You cannot see the box when logged in, but others can
A browser or antivirus warns about your site
These scripts check who is visiting. Many skip logged in admins, known security scanners and search engine bots, and only show the trap to ordinary visitors on Windows. Try a private browser window, a different network, or our free hacked website checker.
Usually through an outdated plugin or theme with a known hole, a stolen admin password, or a hosting account that was already compromised. The injected code is often stored in the database or a theme file rather than in a new plugin, so a quick look at the plugin list misses it.
That depends on where you are and what data you hold, so speak to a legal adviser if customer data was involved. The urgent step is the same everywhere: stop the infection so nobody else is hit.
The real method, in the order it works.
Put the site into maintenance mode or take it offline so no more visitors are infected.
Confirm the infection from a clean device on a private window and save a screenshot.
Search theme files, header and footer settings, and the database for the injected script.
Find the entry point: outdated plugins, unknown admin users, and new PHP files in uploads.
Remove every reinfection route, then reinstall WordPress core, the theme and plugins from clean copies.
Change WordPress, hosting, database and email passwords, and log everyone out.
Ask Google and any blocklists to review the site once it is clean.
How we handle it
This page is built from public research by Rapid7, Sekoia, Bitdefender and New Zealand's NCSC, and from what we see in WordPress cleanups generally. The pattern we warn owners about is deleting the visible script and stopping there. The trap disappears for a day, then the backdoor the attacker left behind puts it straight back. Our cleanups always end with the entry point closed and the hidden admin users and leftover files gone.
Written by Ali Yasin Jatoi
Founder of WebCare Studios. Ali has worked with WordPress for more than 10 years, including managing a Pearl Lemon internal fleet of 150+ sites with WP-CLI automation for updates, security cleanup, and malware removal. He has hands on experience across major hosts including Cloudways, A2 Hosting, Hostinger, and Bluehost.
Site down, hacked, or broken checkout gets a senior engineer within 4 hours. No ticket queues, no bots.
Flat quote up front. If we cannot get you back online, you do not pay. Risk sits with us, not you.
We work on a snapshot first and never touch your live database until the fix is verified safe.
Our founder managed 150+ Pearl Lemon internal WordPress sites. The errors you are seeing are ones we have closed hundreds of times.
Real Cloudflare checks ask you to tick a box or wait a moment. They never ask anyone to open Run, PowerShell or Terminal or paste anything. If the box asks for that, it is fake.
It can. Sites that spread malware often get a red warning in Chrome and a notice in Search Console. Cleaning fast and asking for a review is the quickest way back.
We reply within 8 to 12 hours. Emergency cleanup starts from $249, quoted before we start.
Two fields. Email and your URL. A senior WordPress engineer reads it within minutes and replies on email and WhatsApp with what is wrong and what we will do next.
Real proof and field guides tied to "Fake Cloudflare check on my site".
