My visitors see a fake "prove you're human" page

You see nothing, and they are still right

A customer writes that before reaching your shop, they were shown a verification page announcing unusual traffic, with a message along the lines of "Unusual Web Traffic Detected", asking them to carry out an operation on their own computer to prove they are not a robot. You open your site: nothing. You reload: nothing. You try two other pages: still nothing. It is tempting to decide the customer landed on the wrong site, or has a dubious browser extension.

That is almost always wrong. The code is on your server. What changes is that it does not fire for everyone. Code injected into a theme can decide, on every page load, whether to serve the normal page or the trap, based on what it learns about the visitor: their browser, their operating system, where the visit came from, whether they are logged into the administration. I cannot tell you which criteria a given variant uses — it differs from campaign to campaign — but the principle holds: the site owner, who always arrives the same way, with the same session and the same browser, is the least likely visitor to see anything.

That is also what makes these infections last. As long as nobody reproduces the conditions of a real visitor, the site looks clean from the back office and the problem stays buried in customer service messages.

Where the code hides, and why every theme matters

In May 2025 Sucuri documented a campaign matching exactly what your customers describe. The malicious code is injected into the header.php file of every installed theme, not just the active one. It points to a verification.html file dropped on the server, which holds the fake verification page. The visitor reads that unusual traffic has been detected and that they must run an operation on their machine. If they follow it, they install malware on their own computer. It is an evolution of a campaign Sucuri had already seen in March 2025.

The key point is this: in this pattern the final victim is not your server. Your site is not stolen, not encrypted, its data does not necessarily leave. It acts as a distribution point. That explains the gap between what you measure — a site responding normally, orders coming through — and what your customers experience.

"Every installed theme" is not a detail for the curious. A theme you do not use, left behind after a trial or shipped by default, is still a PHP file on the server. Cleaning only the active theme leaves the rest in place, ready to be called again if the theme changes, and above all creates the belief that the job is done. So I always start from the assumption that the whole themes directory has to be inspected.

A second hiding place needs checking too. The wp-content/mu-plugins/ directory holds "must-use" plugins: they load automatically on every page render, without activation, and do not appear in the plugins list in the dashboard. A site audited only from the admin interface has a complete blind spot there.