ClickFix Remover — Fake CAPTCHA Injection Cleaner for WordPress

ClickFix is the attack that asks your visitors to infect themselves. A compromised page shows what looks like a Cloudflare security check, tells the visitor to press a key combination and paste "the verification code", and the clipboard already holds a command that downloads a payload. No browser exploit, no file download — just a person following instructions.

ClickFix Remover finds that injection and takes it out.

It searches everywhere the payload hides

• Every table in the database, whatever your table prefix is — not just wp_posts and wp_options. Page-builder data, widget content and theme settings are where these injections usually survive a cleanup.
• Every file in the install, PHP and JavaScript alike.

It knows what it is looking for

The signatures are the actual shape of the loader, not a guess: the obfuscated atob() block, indirect (0,eval) execution of the decoded payload, and the long base64 strings that carry it. That specificity is what keeps it from flagging your legitimate JavaScript.

It protects visitors while you work

Turn the shield on and the injection is filtered out of page output immediately, before you have removed a single file. Your visitors stop seeing the fake check while you take your time cleaning up properly.

Everything is reversible

Every file and every database row it touches is backed up first. If a match turns out to be legitimate, you restore it. Nothing is destroyed on your behalf.

What you get

• clickfix-remover-3.0.0.zip — the plugin, ready to upload
• A setup PDF covering the scan, reading the results, the shield, cleaning safely and closing the way back in

Requirements

WordPress 5.0 or newer · PHP 7.0 or newer. Licensed GPLv2 or later. Use it on as many sites as you own.

Removing the injection is half the job. If the site is reinfected, the way in is still open — usually an outdated or abandoned plugin. Inovista Shield covers that side.