Fake Cloudflare CAPTCHA on WordPress (ClickFix)

If your WordPress site is suddenly showing a “Cloudflare verification” page that tells visitors to copy/paste commands to prove they’re human… you don’t have a CAPTCHA problem.

You have a site compromise problem.

This is a real, active campaign: attackers compromise legitimate WordPress sites and inject a fake Cloudflare-style CAPTCHA (“ClickFix”) that tricks visitors into running malicious commands on Windows. Rapid7 describes this as a multi-stage malware chain designed to steal credentials and digital wallets from victims.^[1]

I’m Ben Marshall (full-stack dev + engineering manager). This post is the practical playbook: how to spot the fake CAPTCHA, what to do immediately, how to clean up WordPress, and how to harden your site so it’s harder to re-compromise.

TL;DR: What to do right now

• If you see “copy/paste this command” in a CAPTCHA flow, treat it as malicious and close the page.^{[1] [3]}
• If it’s your site: take it out of rotation (maintenance mode), rotate passwords/keys, and start incident cleanup immediately.^[5]
• Do not “fix” it by adding more CAPTCHA. The fake CAPTCHA is the payload. Your site is compromised.^[7]
• Patch and harden WordPress (core, plugins, themes) and remove anything unneeded or unmaintained.^[5]
• Then layer your defenses so bots and abuse get filtered quietly before they cause damage or chaos.

What is the fake Cloudflare CAPTCHA “ClickFix” attack?

In this campaign, attackers compromise a WordPress site and inject a fake Cloudflare “human verification” page. Rapid7 reports the lure impersonates a Cloudflare CAPTCHA and is designed to infect visitors with malware that steals credentials and digital wallets from Windows systems.^[1]

Trend Micro also describes ClickFix-style campaigns using compromised WordPress sites as a delivery mechanism for malware families that enable reconnaissance and command execution, including persistence behaviors in some variants.^[2]

The “this is absolutely fake” red flags

• The “CAPTCHA” tells the visitor to press Win+R, open a Run box, and paste a command.
• The “verification” involves PowerShell/Terminal or any command execution step.
• The page looks like a normal challenge, but the instructions feel like “IT admin vibes” instead of “click a checkbox.”

Malwarebytes calls this out as social engineering: instead of exploiting a technical vulnerability on the visitor’s machine, the attackers convince the person to run the malicious commands themselves.^[3]

Cloudflare community guidance also notes that some “stuck on Cloudflare CAPTCHA” pages aren’t real challenges at all — they can be malware on the website attempting to trick visitors.^[7]

How WordPress sites get compromised in these campaigns

Rapid7 describes this campaign as widespread and involving legitimate WordPress sites being misused to inject the fake CAPTCHA lure for visitors.^[1] The initial foothold is commonly some combination of outdated plugins/themes, weak credentials, or exposed admin surfaces.

Sucuri has been tracking similar “fake Cloudflare verification” infections for a while, where attackers inject convincing verification pages that push users toward executing steps that lead to malware installation.^[4]

Hard truth: this isn’t “spam” anymore

Spam is annoying. This is visitor harm. If your site is compromised, you’re not just losing leads — you’re risking your users’ devices and your brand trust.

If this is happening on your site: cleanup checklist

Not legal advice, not incident-response-forensics perfection — just a pragmatic “stop the bleeding first” sequence that works for most small-to-mid WordPress sites.

Step 1: Stop the bleed

1. Put the site in maintenance mode or temporarily restrict access (so you’re not serving the lure to more people).
2. Change WordPress admin passwords and hosting panel passwords immediately.
3. Rotate secrets (DB password, API keys, SMTP credentials, anything in env/wp-config) if there’s any chance they were exposed.

Step 2: Remove the compromise

1. Update WordPress core, plugins, and themes to current versions. WordPress hardening guidance emphasizes keeping everything updated as the most important baseline step.^[5]
2. Remove anything unused (plugins/themes you don’t need). Less code is less attack surface.
3. Scan for injected scripts and unfamiliar admin users. If you have a clean backup from before the incident, restoring and re-patching can be faster than manual hunting.
4. Ask your host for help if you’re not comfortable doing cleanup yourself. Many hosts can identify modified files, suspicious cron jobs, or injected content quickly.

Step 3: Verify you’re actually clean

• Test from a clean browser profile and a clean network (no extensions, no cache). If the fake CAPTCHA still appears, you’re not done.
• Re-check the site on multiple pages (attackers sometimes target only first visit or only certain referrers). Rapid7 notes the lure can be injected in ways that don’t “visibly change” the site, which makes it easy to miss if you only check one page.^[1]

How to prevent this (without wrecking UX)

Here’s the boring-but-true part: most compromises become much harder when the basics are tight.

1) Follow WordPress hardening basics

WordPress’ hardening guide is still the best “baseline” checklist: keep everything updated, reduce risky defaults, and treat security like maintenance, not a one-time project.^[5]

2) Use layered protection for abuse entry points

Even though this attack is a site compromise, abuse entry points still matter: bots hammer logins, registrations, and forms relentlessly. Layered defense helps reduce noise and risk by filtering repeat offenders and automation patterns quietly.

Zero Spam for WordPress blocks spam and malicious submissions across common WordPress flows using layered signals and reputation integrations (including Stop Forum Spam and Project Honey Pot).^[6]

If your forms are business-critical and you want stronger accuracy signals, a Zero Spam API license adds deeper intelligence like confidence scoring (and additional reporting history on higher tiers) so you can reduce spam and tune strictness without guessing.^[8]

Discount if you want it: use code ZEROSPAM20 for 20% off a Zero Spam License.^[9]

About Ben Marshall

Full-stack Developer & Engineering Manager

Ben Marshall is a full-stack developer and engineering manager who loves building solid software and helping teams do their best work. He’s equal parts builder and coach—focused on practical architecture, clean implementation, and making collaboration easier (and faster) for everyone.

• WordPress.org