Fake Cloudflare CAPTCHA on WordPress: How We Removed It

How We Removed a Fake Cloudflare CAPTCHA from a WordPress Website

Key takeaways

A real Cloudflare check never asks you to press Windows + R, open a terminal or paste anything. If a "CAPTCHA" does, it is fake.
A fake Cloudflare CAPTCHA on your own website means the site has been compromised, usually through theme files, plugins or the database.
The fake page is often shown only to some visitors, so "it looks fine to me" does not prove the site is clean.
Back up first, remove every copy of the injected code, then close the way in.
Anyone who ran the command should treat their device as infected.

A fake Cloudflare CAPTCHA is a security check that looks like Cloudflare's "Verify you are human" page but is really malware injected into a website. Cloudflare is widely used to protect websites from bots and malicious traffic, and most people have seen its checks before. That familiarity is exactly why attackers copy them.

We recently dealt with this on a client's WordPress website. Visitors were shown a verification screen that looked like a legitimate Cloudflare security check, but it was not part of the website and Cloudflare had not generated it. That pointed to one conclusion: the website had been compromised.

In this article, we walk through how we confirmed the problem, where fake CAPTCHA code hides in WordPress, how we removed it and what we changed to stop it coming back. It is written for WordPress website owners and the developers who look after their websites.

What a Fake Cloudflare CAPTCHA Looks Like and How to Tell It Is Fake

The first sign of the problem was a Cloudflare-style CAPTCHA appearing on the website. At first glance, it looked like a standard Cloudflare security challenge. But the website was not set up to show this page, and the behaviour suggested that something had changed the normal website experience.

Fake pages copy Cloudflare's design closely, including the logo, a "Verify you are human" checkbox and even a made-up Ray ID. The difference is what happens after the visitor ticks the box. The page then shows "verification steps" like these:

Press Windows + R.
Press Ctrl + V.
Press Enter.

Behind the scenes, ticking the box quietly copied a command to the visitor's clipboard, using the browser's Clipboard API. Pasting it into the Windows Run box starts PowerShell, which downloads malware. This is usually an information stealer that takes saved passwords, browser sessions and cryptocurrency wallets. Security researchers call the technique ClickFix, and Microsoft's analysis of ClickFix shows it has also been adapted to target Mac users.

Real Cloudflare Challenge vs Fake Cloudflare CAPTCHA

Check	Real Cloudflare challenge	Fake Cloudflare CAPTCHA
What it asks you to do	Nothing, or tick a box or press a button	Press Windows + R, then paste and run a command
Where it comes from	Cloudflare's network, triggered by the site owner's own security rules	Code injected into the website's files, database or scripts
When it appears	Before the page loads, usually for a few seconds	On top of a normal page, often only for some visitors
The Ray ID	A real reference number from Cloudflare	Decoration, copied to make the page look convincing

Cloudflare's own documentation describes interactive challenges as asking visitors to do things like check a box or select a button. Malwarebytes makes the same point from the other side: legitimate services never ask you to paste commands into Windows to prove you are human.

Fake CAPTCHA attacks are dangerous because they exploit people's trust in familiar security screens. Depending on the attack, visitors may be tricked into:

Copying and running malicious commands.
Downloading suspicious files.
Granting permissions they should not grant.
Providing sensitive information.
Interacting with malicious third-party websites.

A fake CAPTCHA should therefore be treated as a security incident rather than an ordinary display issue.

How Fake Cloudflare CAPTCHA Injections Work in WordPress

A legitimate Cloudflare challenge is generated and managed by Cloudflare's security infrastructure. A fake CAPTCHA, on the other hand, is injected directly into a compromised website or introduced through a third-party script.

In WordPress, the injected code can sit in:

Modified WordPress core files.
Compromised themes or plugins, including fake plugins the attacker installed.
Must-use plugins in the wp-content/mu-plugins folder, which load automatically and do not appear in the normal plugin list.
Malicious JavaScript added to the website.
Injected PHP code.
Modified database records.
Compromised third-party scripts.
Unauthorised changes to the website's configuration.

This is not theoretical. Sucuri documented a fake Cloudflare verification attack that injected code into the header.php file of every installed theme, which then loaded a separate file holding the fake page. Other campaigns, such as the ClearFake campaign analysed by Darktrace, fetch the next stage of the attack from a blockchain, so it is harder to take down.

Many injections also show the fake page only to some visitors. Sucuri's example targeted Windows users, and some campaigns skip people who are logged in or look like security scanners. That is why a website owner who checks their own site while logged in may see nothing wrong.

The challenge is finding where the malicious behaviour comes from. Simply removing the suspicious CAPTCHA screen does not resolve the underlying security problem.

Step 1: Confirm the Fake CAPTCHA and Preserve Evidence

Our first step was to investigate the website rather than immediately changing how it looked. The aim was to find out whether the suspicious behaviour came from WordPress itself, an installed extension or an external service.

First, check whether the website is behind Cloudflare at all. If it is not, any Cloudflare page on it is fake. Requests that pass through Cloudflare come back with a cf-ray header:

curl -sI https://example.com | grep -i -E "^(server|cf-ray):"

If you see server: cloudflare and a cf-ray value, the site uses Cloudflare, but that does not make the CAPTCHA genuine. A real challenge is triggered by a rule in your own Cloudflare account, so check whether any rule is set to challenge visitors on that page.

Next, load the page the way a targeted visitor would: logged out, on Windows, in a normal browser. This command fetches the homepage with a Windows browser signature and looks for the usual warning signs:

curl -s -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0 Safari/537.36" \
  https://example.com \
  | grep -i -o -E ".{0,60}(verify you are human|navigator\.clipboard|powershell|mshta).{0,60}"

Opening the site in a private window with the Network panel in Chrome DevTools also shows which script loads the fake page, and from which domain.

Before changing anything, take a full copy of the files and database. It records how the attack worked, gives you something to compare against and lets you roll back if a cleanup step breaks something:

wp db export ../before-cleanup.sql
tar -czf ../files-before-cleanup.tar.gz .

These commands use WP-CLI, the command-line tool for WordPress, run from the website's root folder. The ../ saves both copies one folder above the website, so they cannot be downloaded from the web. Do not restore from this backup later, because it contains the malware.

Step 2: Find the Injected Code in WordPress Files

WordPress core files, themes and plugins are common places to look when a website behaves unexpectedly. We focused on suspicious modifications, unfamiliar PHP files and unexpected JavaScript.

Pay particular attention to files that load on every page request, including:

functions.php
wp-config.php
header.php
footer.php
Plugin bootstrap files
Anything in wp-content/mu-plugins
Custom JavaScript files
The .htaccess file

Unexpected code in these locations can affect the entire website. WP-CLI can check WordPress core and plugin files against the official copies on WordPress.org:

wp core verify-checksums --include-root
wp plugin verify-checksums --all

wp core verify-checksums lists any core file that has been changed, and --include-root also warns about unexpected files in the root folder. The plugin check compares files with WordPress.org's checksums, so premium plugins bought elsewhere need replacing with fresh copies from the vendor.

To find recently changed files, PHP files where they should not be and code that writes to the clipboard, run these from the website's root folder:

# PHP and JavaScript files changed in the last 14 days
find . -type f \( -name "*.php" -o -name "*.js" \) -mtime -14 -not -path "./wp-content/cache/*"

# PHP files in the uploads folder (there should be none)
find wp-content/uploads -type f -name "*.php"

# Must-use plugins, which load automatically
ls -la wp-content/mu-plugins

# Code that writes to the clipboard or mentions PowerShell
grep -rliE "navigator\.clipboard|powershell|mshta|verify you are human" wp-content --include="*.php" --include="*.js" --include="*.html"

# Common ways of hiding PHP code
grep -rlE "eval\(base64_decode|gzinflate\(base64_decode|str_rot13\(" wp-content --include="*.php"

A match is a lead, not proof. Some legitimate plugins use these functions, so open each file and check what the code actually does. In another WordPress cleanup with hidden malware, the infection had been designed specifically to avoid simple searches like these.

Step 3: Check the Database for Injected Scripts

A WordPress database can also hold injected scripts, which WordPress then outputs on the front end. Common locations include:

wp_options
wp_posts
wp_postmeta
Theme and plugin settings records

wp db search searches database tables without exporting them:

wp db search "<script" wp_options wp_posts wp_postmeta --one_line
wp db search "clipboard" --all-tables --one_line
wp db search "powershell" --all-tables --one_line

Change the table names if your site uses a prefix other than wp_. Legitimate tracking codes also contain script tags, so review each match rather than deleting matches in bulk.

Step 4: Review Third-Party Scripts, Users and Scheduled Tasks

Third-party JavaScript can introduce unexpected behaviour even when the WordPress installation itself appears normal. Analytics scripts, advertising integrations, tracking tools and external libraries should all be reviewed. The aim is to separate legitimate integrations from unauthorised or compromised scripts.

Attackers also leave ways back in. List every administrator account and every scheduled task, and question anything you do not recognise:

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp cron event list --fields=hook,next_run_relative,recurrence

An administrator account created around the time the problem started, or a scheduled task with a random-looking name, is a strong sign of how the attacker planned to return.

Step 5: Remove the Fake CAPTCHA at the Source

Once the source has been found, the cleanup should deal with the cause rather than just hiding the verification screen. A proper cleanup includes:

Removing unauthorised or malicious code.
Restoring modified WordPress core files from the official WordPress package.
Reinstalling compromised themes and plugins from trusted sources.
Reviewing and cleaning affected database records.
Removing unfamiliar or unauthorised files.
Removing unexpected administrator accounts and scheduled tasks.
Reviewing server-level configuration and access points.

Removing one injected script without finding out how it got in can leave the website open to reinfection, and fake CAPTCHA attacks often place copies in several locations. Our WordPress malware removal guide covers each cleanup step in more detail.

Step 6: Lock the Website Down After Cleanup

Once the code has gone, assume every password and login session may have been seen. These WP-CLI commands invalidate existing logins and bring everything up to date:

# New security keys: logs everyone out of WordPress
wp config shuffle-salts

# End every user's saved sessions
wp user list --field=ID | xargs -n 1 wp user session destroy --all

# Update WordPress core, plugins and themes
wp core update && wp plugin update --all && wp theme update --all

Then add this line to wp-config.php, so a stolen administrator login cannot be used to edit theme and plugin files from the dashboard:

define( 'DISALLOW_FILE_EDIT', true );

The WordPress hardening guide explains this setting and others. Finally, change the passwords for the hosting control panel, SFTP, the database and the Cloudflare account, and check who has access to each one.

Step 7: Verify the Website and Clear Every Cache

After the cleanup, test the website to make sure the suspicious behaviour has gone. We recommend checking:

The homepage and internal pages.
WordPress administration pages.
Image uploads and media.
Browser console errors.
Network requests to unfamiliar external domains.
The website in different browsers and in private windows, logged out.
Server logs for suspicious activity.

If the website uses Cloudflare, review its security settings to make sure legitimate challenges still work. Then clear every cache, including WordPress, the server and the browser, and purge everything in Cloudflare, so visitors receive the clean website rather than a cached copy of the infected one.

If Google has flagged the website, its Security issues report in Search Console shows the problem. Once the site is clean, request a review there to remove the warning.

What to Do If a Visitor Ran the Command

If anyone followed the fake instructions, their computer should be treated as infected:

Disconnect it from the internet and run a full scan with up-to-date security software, or ask an IT provider to check or rebuild it.
From a different, clean device, change the passwords for email, banking and work accounts, and sign out of all sessions. Stolen browser sessions can keep an attacker logged in even after a password change.
Turn on two-step verification wherever it is available.

The UK's National Cyber Security Centre has clear guides on recovering an infected device and recovering a hacked account.

As the website owner, consider telling affected users, as New Zealand's National Cyber Security Centre recommends. If personal data held on the website may also have been accessed, check whether you need to report it to the Information Commissioner's Office (ICO). UK organisations must report qualifying breaches within 72 hours of becoming aware of them.

How to Prevent Fake CAPTCHA Malware on WordPress

Removing malicious code is only part of the process. Preventing another compromise is just as important. These are the security practices every WordPress website owner should follow, and they form the core of good WordPress maintenance.

Keep WordPress and PHP Updated

Regularly update WordPress core, themes and plugins, and remove extensions that are no longer maintained or needed. Keep the server software up to date as well: an unsupported PHP version can be exploited even when WordPress itself is current. Our PHP upgrade services cover this.

Use Trusted Plugins and Themes

Download extensions from reputable sources, and never use nulled or modified copies of premium themes and plugins. They are one of the most common ways malware gets into WordPress.

Secure Administrator Accounts

Use strong, unique passwords, turn on two-factor authentication and remove administrator accounts that are no longer needed.

Monitor File Changes

Check important WordPress files regularly for unexpected changes. Most WordPress security plugins include file change alerts, which can flag an injection within hours instead of weeks.

Review Third-Party Scripts

Only load scripts from providers you trust, and review external JavaScript regularly. A Content Security Policy can go further by telling browsers which domains are allowed to supply scripts, so an injected script from an unknown domain is blocked.

Maintain Regular Backups

Keep secure backups of both the website files and the database, store them away from the website, and test that they can actually be restored.

Use Cloudflare Correctly

Cloudflare provides useful security features, but it does not replace WordPress security. It filters traffic before it reaches your server, but it cannot remove code that is already inside your files or database. Review security rules, account access, API tokens and DNS settings regularly. Managed hosting adds server-level protection and monitoring underneath it.

Conclusion

A fake Cloudflare CAPTCHA is more than a front-end inconvenience. It is a warning sign that something has gone wrong with a website's security.

When it happens, removing the visible verification screen is not enough. The underlying source must be found, every unauthorised change must be removed, and the website should be checked for other signs of compromise.

WordPress security takes more than installing a security plugin. It involves understanding how the website works, monitoring its files and integrations, and responding properly when something unusual happens.

The most important lesson is simple: investigate the source of suspicious behaviour, fix the root cause and verify that the website is secure before treating the incident as resolved.

FAQs About Fake Cloudflare CAPTCHAs

Is the Cloudflare "Verify you are human" page real?

It can be. A real Cloudflare check only asks you to tick a box or press a button, and often needs no action at all. If a page asks you to press Windows + R, open a terminal or paste a command, it is fake.

Why is a fake Cloudflare CAPTCHA showing on my WordPress website?

It usually means the website has been compromised. Attackers inject code into theme files, plugins or the database, and that code loads the fake page for visitors.

What is ClickFix?

ClickFix is a social engineering technique in which a fake error or CAPTCHA page tricks people into copying and running a command themselves. The command downloads malware, often an information stealer.

Does Cloudflare protect my WordPress website from this?

Not on its own. Cloudflare filters traffic before it reaches your server, but it cannot remove code that is already inside your WordPress files or database.

Why can I not see the fake CAPTCHA on my own website?

Many injections show the fake page only to some visitors, such as Windows users, and some hide it from logged-in administrators and security scanners. Check the website logged out in a private window, or ask someone to check it on a different device.

Will a security plugin remove a fake CAPTCHA?

It may find and remove some of the code, but it can miss injections in the database or in files it does not scan. A full cleanup also closes the way in, changes passwords and checks the website as a visitor would see it.

What should I do if I ran the command from a fake CAPTCHA?

Disconnect the device from the internet and scan it with up-to-date security software, or have it checked by an IT provider. From a clean device, change your passwords, sign out of all sessions and turn on two-step verification.

Can Google flag my website because of a fake CAPTCHA?

Yes. If Google detects malware, it can show warnings to searchers and visitors. Once the website is clean, request a review from the Security issues report in Google Search Console.

Sources and Further Reading

Another Fake Cloudflare Verification Targets WordPress Sites (Sucuri)
ClickFix social engineering technique floods threat landscape (Proofpoint)
Cloudflare challenges documentation (Cloudflare)
FAQ: My site was hacked (WordPress.org)

Need Help Removing a Fake CAPTCHA from WordPress?

If your WordPress website is showing a fake Cloudflare CAPTCHA, or any verification page you did not set up, take it seriously and act quickly. Our website security services team investigates the infection, removes it at the source, closes the way in and checks the website from a visitor's point of view. If you need help with a fake Cloudflare CAPTCHA or any other WordPress security problem, get in touch today.

About the Author

Rehan Ahmed is the CEO of Smart Web Agency, which builds, maintains and secures WordPress, Laravel and custom websites for businesses in London, Kent and across the UK. Connect with Rehan on LinkedIn.