This case study is about a security incident where our WordPress website was attacked from more than one direction at once. The trouble began when hackers discovered a security gap in one of the plugins we had installed. Using that gap, they managed to secretly add a fake administrator account to our site, one that we never created ourselves.
We deleted the account as soon as we spotted it, thinking that would end the matter. But to our surprise, the exact same account showed up again just minutes later. At first this made no sense. Eventually we discovered the real reason: there was hidden code buried inside one of our theme files that was silently rebuilding the account on its own, every time a page on our site loaded. That meant deleting it manually was pointless, since it would just come right back.
Around the same time, we started noticing something odd happening on the front end of our site. People visiting our pages were being shown a popup that looked identical to Cloudflare’s usual “verify you are human” screen. It seemed completely genuine, but it was fake. This is part of a known scam method called ClickFix, where attackers copy a trusted-looking prompt to gain a visitor’s confidence. In our case, the fake popup was also quietly attempting to interact with any cryptocurrency wallet connected to the visitor’s browser, which is a tactic often used to steal digital funds.
Solving the problem meant going through everything carefully. We opened up browser developer tools, went through our database, and read through our theme files one section at a time. Bit by bit, we located every hidden piece of malicious code across different parts of the site, removed each one, and finally understood why our earlier fixes hadn’t worked.
Beyond just describing the attack, this case study also breaks down the type of vulnerability that allowed it to happen in the first place. It walks through the changes we made afterward to strengthen our site’s security, including switching off WordPress’s built-in code editor and building a custom plugin of our own that keeps watch for suspicious activity, sends alerts, and stops unauthorized changes to admin accounts. To wrap up, it offers a few straightforward, practical tips that other WordPress site owners can use to protect themselves from a similar attack.
Read in detail: https://zainulabideen.blog/wordpress-hacked-fake-cloudflare-popup-compromised-our-site/