A visitor opens the website and the browser offers an unfamiliar ZIP, APK, executable or document. Treat this as an active safety incident. Do not open the downloaded file, upload it to a public scanner or ask more customers to reproduce the behaviour.
The download can be initiated by an HTTP response, injected JavaScript, a redirect, a compromised advertisement or a previously registered service worker.
Contain visitor exposure first
If the report is credible, restrict public access or serve a static maintenance response from a known-clean layer while preserving the infected environment. Coordinate with the host and CDN so cached malicious pages are not still public.
Do not delete the reported file immediately. Preserve its name, cryptographic hash, timestamps and source URL from an isolated environment. Store it without execution permission and restrict access.
Never email the attachment to a developer or support desk.
Collect non-executable evidence
Ask the reporter for page URL, time, browser, device, referrer and displayed filename. A screenshot of the browser download prompt is safer than the file.
In a disposable analysis profile, record the browser network log and stop before opening the payload. Note whether the initial site response is HTML, a redirect or the download itself.
Avoid logging into WordPress from the same profile used to visit the malicious path.
Inspect response headers
For an authorised URL, inspect headers without saving the body:
curl -sS -I https://example.com/suspected-path/Look for unexpected Content-Disposition: attachment, unusual content type, redirect location or filename. A JavaScript-triggered download may not appear in a header-only request.
Compare the first visitor response with a logged-in administrator view and a second clean session. Malware may target only mobile, search referrers or first visits.
Trace the initiating request
In the browser network panel, identify which response delivered the bytes and which element or script initiated it. Check for:
- injected
<script>or iframe; - calls to unfamiliar external domains;
- blob/object URLs created in the browser;
- ad or tag-manager scripts;
- a service worker intercepting navigation;
- server redirects to another host.
Preserve URLs as text. Do not browse the external infrastructure beyond what is necessary to understand your own site’s request chain.
Search WordPress and the hosting account
Review recently changed PHP and JavaScript files, unknown plugins, must-use plugins, theme files, root configuration and uploads containing executable code. Search the database for injected script tags and external domains found in the network evidence.
Check hosting-level redirects, cron, DNS and neighbouring sites. A compromised control panel can reinsert the payload after WordPress files are cleaned.
Do not use a scanner’s single detection as the whole scope. It may find the delivered file but miss the loader or credential compromise.
Consider service-worker persistence
A malicious or obsolete service worker can continue controlling visits after the origin is repaired. Inspect registered workers and their script URLs in the isolated browser.
Remove the malicious registration path at the server and provide a clean worker/update strategy. Visitors may need a fresh navigation before the old worker relinquishes control.
Do not tell users to clear their browser as the only repair. The origin and registration mechanism must be fixed.
Clean, close and verify
Preserve evidence, remove confirmed loaders and payloads, replace modified trusted files from verified sources and rotate affected credentials. Patch the entry route and inspect scheduled persistence.
Retest the original page/referrer/device combination with clean storage. Confirm no download, external redirect or suspicious worker occurs. Review CDN content and monitor new file changes and outbound requests.
Request urgent response
An unexpected executable or mobile package warrants urgent containment. Send the public URL, time, filename and screenshot through the enquiry—never the file or passwords.
A professional cleanup should explain what triggered the download, what was removed, how reinfection was prevented and how the original condition was verified safely.