Last reviewed: September 2, 2026
If visitors are seeing a reCAPTCHA, Cloudflare verification screen, or “prove you are human” message on your WordPress site that you did not add, treat it as a possible website compromise or a fake reCAPTCHA on your website.
The biggest warning sign is simple: a legitimate CAPTCHA will never ask someone to press Windows + R, open PowerShell or Terminal, paste a command, and press Enter.
That behavior is associated with a social-engineering technique commonly called ClickFix. Attackers compromise legitimate websites and use them to show fake verification prompts. The website itself may continue to look and work normally, while the fake prompt attempts to infect visitors’ computers. Cybersecurity researchers have repeatedly documented ClickFix being distributed through compromised WordPress sites.
If this is happening on your site, do not keep clicking the prompt to investigate it. Take a screenshot, confirm the behavior safely, and start treating the website as compromised.
What Is the Fake CAPTCHA on Your WordPress Site?
The fake CAPTCHA is not usually a broken CAPTCHA plugin.
It is malicious code designed to look like a normal Google reCAPTCHA, Cloudflare verification page, browser update, or similar security check.
A typical ClickFix attack works like this: a visitor opens a compromised website and sees what looks like a human-verification prompt. When they interact with it, JavaScript on the page may place a malicious command into their clipboard. The visitor is then told to press Windows + R, paste the command, and press Enter.
Instead of verifying anything, those steps execute attacker-controlled code on the visitor’s computer. Sucuri documented this exact pattern on compromised WordPress sites, including the clipboard-copy behavior and Windows Run instructions.
Different ClickFix campaigns deliver different malware. Security researchers have observed credential stealers, remote-access malware, ransomware-related payloads and other malicious tools. Rapid7’s 2026 investigation of compromised WordPress websites found malware designed to steal credentials, browser data and cryptocurrency-wallet information.
The important distinction is this: your WordPress site is the delivery mechanism, while your visitor’s computer is one of the attacker’s targets.
That is also why the website may not appear obviously broken.
How to Confirm the Fake reCAPTCHA in About Two Minutes
One of the most frustrating things about this infection is that customers may see it while you cannot.
That does not mean the customer is mistaken.
Some ClickFix injections intentionally avoid WordPress administrators, automated crawlers and security scanners. Rapid7 analyzed WordPress malware that specifically checked for WordPress login cookies and stopped its malicious code from loading when it detected them. The same code also attempted to exclude bots, crawlers and automated tools.
The New Zealand National Cyber Security Centre issued a ClickFix alert on September 2, 2026 stating that some infected websites behave normally for scanners and search crawlers while displaying malicious content to real browser visitors. It recommends testing through normal and incognito browser sessions, different IP addresses, and both mobile and desktop devices.
Start by opening your website in an incognito or private window on a desktop computer. Make sure you are not logged into WordPress.
If the prompt does not appear, try another browser or another internet connection. You can also try reaching the website through a search result rather than through your normal admin workflow.
Do not follow the verification instructions if the prompt appears.
Take a screenshot instead. Record the URL, browser, device and approximate time. This gives your hosting provider or malware-removal specialist something concrete to investigate.
If you are comfortable inspecting HTML, viewing the page source may also reveal unfamiliar or heavily obfuscated JavaScript. Sucuri documented malicious WordPress injections where JavaScript visible in page source fetched additional attack content from external infrastructure.
Why Does Wordfence or Your Host Say the Site Is Clean?
This is where many WordPress owners get stuck.
A customer reports malware. You run Wordfence. Nothing appears. Your hosting company’s automated malware scanner also says everything is fine.
Then you open the website yourself and still cannot reproduce the problem.
A clean scan does not necessarily prove the website is clean.
One reason is conditional delivery. Malware can check whether the visitor looks like a logged-in administrator, crawler, scanner or normal user before deciding whether to show the malicious content. Rapid7 found exactly this type of filtering in compromised WordPress sites.
Another reason is that the full malicious payload may not be stored directly inside an easily detectable WordPress file. In the ClickFix campaign investigated by Sucuri, injected code retrieved additional malicious content through the Binance Smart Chain before displaying the fake reCAPTCHA. A scanner may therefore encounter a loader or obfuscated script rather than a familiar malicious executable or signature.
Malware can also hide in unexpected parts of WordPress.
Sucuri found ClickFix-related malicious plugins that attempted to hide themselves from the normal WordPress plugin interface, as well as infections inserted directly into a theme’s functions.php. WordPress’s own documentation also confirms that files in wp-content/mu-plugins are automatically enabled and are not displayed in the normal plugin list.
This is why a targeted investigation may need to examine more than the standard Plugins screen.
What Should You Do in the Next Hour?
If you have confirmed a fake CAPTCHA or ClickFix-style prompt, focus on containment rather than randomly deleting files.
- Do not interact with the fake verification prompt. Do not paste or execute anything it copied to your clipboard.
- Save evidence. Take screenshots and note where and when the prompt appeared.
- Consider temporarily taking the affected site offline or placing it in maintenance mode if visitors are actively being exposed. The NCSC specifically recommends taking an infected site offline when the owner cannot safely remediate it themselves.
- Change privileged WordPress and hosting credentials from a device you believe is clean, especially if someone on your team followed the fake CAPTCHA instructions.
- Check Google Search Console’s Security Issues report. Google may flag hacked content, malware or behavior that could harm visitors, although a clean Security Issues report should not be treated as proof that no infection exists.
- Move from diagnosis to a proper WordPress malware cleanup. Do not assume deleting the visible CAPTCHA script has removed the attacker’s access.
For the complete first-hour response process, continue with our WordPress Site Hacked: What to Do guide. If you already know the site is infected and need the deeper cleanup process, see our WordPress Malware Removal guide.
What If You Clicked the Fake CAPTCHA Yourself?
There is an important difference between clicking the fake CAPTCHA and following all of its instructions.
Some versions copy a command to the clipboard when you click. If you stopped there and never pasted or executed the command, that alone does not establish that malware was installed on your computer.
The higher-risk situation is when you pressed Windows + R or opened PowerShell/Terminal, pasted the copied command and executed it.
If you did that, treat the computer itself as potentially compromised.
Modern infostealers delivered through ClickFix campaigns can target saved browser credentials, cookies, password stores and cryptocurrency-wallet data. Rapid7’s investigation specifically documented browser-cookie theft and credential collection in a WordPress-delivered ClickFix campaign.
Run a reputable endpoint-security scan and avoid using that computer to change important passwords until you are confident it is clean.
Then change your WordPress administrator, hosting, FTP/SFTP and other important credentials from a different clean device. Enable multi-factor authentication wherever possible.
This matters because stolen administrator credentials can give an attacker a route back into a website even after visible malware has been removed.
What Should You Tell Visitors?
Fake CAPTCHA malware is different from many WordPress infections because the immediate danger may fall on your visitors rather than only on your website.
If you know visitors were exposed, communicate clearly.
Tell them that an unauthorized verification prompt was displayed on the website and that they should not execute any command copied by the page.
If someone tells you they already pasted and ran the command, advise them to run an endpoint malware scan and review important credentials from a clean device.
The NCSC’s September 2026 guidance similarly recommends warning exposed visitors not to execute clipboard commands and advising affected users to scan their devices and reset passwords.
Do not hide the problem behind vague language such as “temporary technical issue” if people may have executed malware because of your website.
Why Does the Fake CAPTCHA Keep Coming Back?
Removing the popup is not the same as removing the compromise.
Attackers may leave additional access mechanisms behind.
Sucuri found ClickFix infections accompanied by malicious WordPress plugins functioning as backdoors so attackers could maintain access even if the primary visible payload was removed.
That means deleting one suspicious JavaScript snippet, reinstalling a CAPTCHA plugin or clearing your WordPress cache may appear to solve the problem without removing the underlying access.
This is also why installing a legitimate CAPTCHA plugin will not fix a ClickFix infection.
The fake CAPTCHA is a symptom of the compromise, not evidence that your real CAPTCHA settings need adjusting.
A complete cleanup should identify the malicious code, remove persistence, review administrator access and determine how the attacker entered the site in the first place.
Our WordPress Malware Removal guide covers that process in more detail. After the cleanup, follow the How to Secure a WordPress Site checklist to reduce the chance of reinfection.
Frequently Asked Questions
Is the reCAPTCHA on my WordPress site real or fake?
A major warning sign is any verification prompt asking you to leave the browser and run a command. A legitimate Google reCAPTCHA or Cloudflare verification challenge will not ask visitors to press Windows + R, open PowerShell or Terminal, paste a command and execute it.
Why does the CAPTCHA appear to visitors but not to me?
Malicious WordPress code can check login cookies, browser characteristics, referrers and user-agent information before deciding whether to show the payload. Some ClickFix campaigns deliberately hide themselves from administrators, crawlers and automated scanners.
Why does Wordfence say my website is clean?
A traditional file scan may miss visitor-specific or remotely loaded malicious content. A clean Wordfence or hosting scan is useful information, but it should not override direct evidence such as screenshots or reproducible malicious behavior.
Will installing another CAPTCHA plugin remove the fake CAPTCHA?
No. If the prompt is being created by malicious injected code, adding a legitimate CAPTCHA plugin does not remove the infection. The compromised files, database entries, malicious plugins, backdoors or other persistence mechanisms must be investigated.
Can the fake CAPTCHA infect my visitors?
Yes, particularly if a visitor follows the instructions and executes the copied command. ClickFix campaigns have been documented delivering credential stealers and other malware. Simply seeing the prompt is different from executing its instructions, but anyone who ran the command should treat their device as potentially compromised.
Do Not Ignore a Fake CAPTCHA on Your Site
A fake reCAPTCHA appearing on your WordPress site is not something to solve by clearing the cache or reinstalling a CAPTCHA plugin.
If the prompt asks visitors to run commands outside their browser, assume the website may be compromised.
Capture evidence, stop exposing visitors where practical, secure your credentials and investigate the site properly.
Once you have confirmed the infection, the next step is not more testing. It is cleanup.
