At a glance
A lead-generating site
that stopped generating leads.
What visitors saw
A “verification”
that nobody could get past.
Every visitor to the homepage got a full-screen box styled like a Google verification, asking them to enter a one-time code. It couldn't be closed and the page underneath couldn't be used, so enquiries stopped.
A real Google reCAPTCHA never asks for a one-time code and never covers a whole website. The site's genuine reCAPTCHA, on its contact form, sits in the background and doesn't interrupt anyone.
What was happening
Injected code aimed
at the site's visitors.
The site had been compromised and was loading injected JavaScript that drew a fake CAPTCHA over every page. Fake-verification overlays are a well-documented technique that security researchers call “ClickFix”, used in campaigns against WordPress sites such as ShadowCaptcha, reported in August 2025.
The target is the site's visitors, not the owner: the overlay tries to get people to hand over codes or information, or to run something on their own computer.
Why it was hard to find
Clean on the surface.
Not clean underneath.
Dashboard: nothing
No strange plugin and no obvious change. Everything in the WordPress admin looked normal.
Manual search: nothing
A long search of the database and files by hand came up empty. The code was written to avoid being found by eye or by a simple text search.
AI-assisted scan: found
Scanning the site's source with AI assistance identified the file path that loaded the overlay. An engineer checked it and removed it.
What we did
Removed it, then closed
the doors it came through.
Found and removed it
After the manual search, an AI-assisted scan of the source located the hidden script, and it was removed.
Put a firewall in front
There was no firewall on the day of the hack. Now traffic is filtered before it reaches the site, so known attack patterns and bad bots are stopped at the edge.
Switched on site protections
A security layer on the site itself, with its protections enabled, guards the areas this kind of attack goes after.
The lesson
“The scan says clean”
isn't the same as clean.
If the dashboard or a plugin scan says everything is fine but visitors still see something wrong, the site isn't clean yet. Signs to act on straight away:
More case studies
See all →The Stairlift Company
A stair lift installer's website rebuilt for older readers and planned around what local buyers search for. Clicks from Google went from 9 to 103.
Read the case study Hack cleanup HundredsSpam pages removed at the sourceWone8 Estates
Hundreds of injected spam pages removed from the database and files, the site locked down, and Google asked to re-crawl.
Read the case study