Fix today

Your page contains an invisible embedded window

What it means

A frame (an iframe) is a window that shows one web page inside another. Normal frames hold things you can see, such as a map, a video or a booking form. EverThread found a frame that is invisible: set to not display, shrunk to a few pixels, made fully transparent, or pushed far off the screen.

We already ignore hidden frames from well-known payment, video, analytics, chat and form services, because they use them routinely. The frame we found loads an address outside that list.

Why it matters

An invisible frame runs whatever page it loads in your visitor's browser, under your name, without anyone seeing it. Attackers use this to rack up fake ad views, set affiliate cookies they get paid for, run crypto-mining that slows visitors' devices, or load pages that try to attack the browser.

It also usually means someone could change your site. Google can flag pages that load harmful content, which puts a warning in front of your visitors and hurts your search listing.

How to check your own site

1. Note the address in the alert. Do not open it directly. If it is harmful, it may try to attack the browser that visits it.
2. Ask yourself, and anyone who works on your site, whether you use a service with that name. Ad networks, affiliate programs and some marketing tools do use hidden frames legitimately.
3. Search the web for the domain name. A real service usually has a website and help pages that mention it. No results, or only warnings, is a bad sign.
4. View the page source (Ctrl+U, or Cmd+Option+U on a Mac) and search for iframe to see where the frame sits. Check a few other pages too. If it appears on every page, it is in your template, a plugin or site-wide code. If only on one, it is in that page's content.

How to fix it

Any website

1. If you recognize the service and still use it, you can keep it. Acknowledge the finding in your EverThread dashboard so it stops alerting.
2. If you recognize it but no longer use it, remove its code from wherever it was added.
3. If you do not recognize it, treat the site as hacked. Back up the site as it is, then change every password tied to it: admin, hosting, FTP, database and the email used for resets. Remove admin users you do not know.
4. Remove the frame, then find how it got in. The usual causes are an outdated plugin, theme or app, a reused password, or an old copy of the site left on the same hosting.
5. If Google has flagged the site, open Security & Manual Actions, then Security issues, in Google Search Console, and request a review once it is clean.
6. If the frame comes back after removal, or your site takes payments, bring in a professional. The spam cleanup guide walks through a full cleanup.

WordPress

1. Check the places code gets added site-wide: theme settings, the Customizer, widgets, and any plugin that inserts code into the header or footer.
2. Deactivate plugins one at a time and reload the page source. If the frame disappears, you have found the source. A test copy of the site is the safest place to do this.
3. Search your posts and pages for the frame's domain, and check header.php, footer.php and functions.php in your theme.
4. Update WordPress, plugins and themes, delete ones you do not use, and reinstall the current version under Dashboard, Updates to restore clean core files.

Shopify, Squarespace, Wix and other hosted builders

1. Check custom code first: the theme code on Shopify (especially theme.liquid), Code Injection on Squarespace, and Custom Code in the Wix site settings. Menu names change, so search the help center if needed.
2. Review installed apps. An app you removed can leave its code in the theme, so check the theme after removing one.
3. If you did not add it and cannot find it, change your password, turn on two-step verification, review staff accounts, and contact platform support.

cPanel hosting

1. If your plan includes Terminal, search your files for the domain from the alert (see the developer section). Otherwise ask your host to run the search.
2. In File Manager, sort by Last Modified to spot files that changed recently, and check Cron Jobs for tasks you did not create.

Cloudflare

1. Check Workers and any third-party tools loaded through Cloudflare. Both can add code to pages.
2. After removing the frame, purge the cache under Caching, Configuration so the old copy stops being served.

What to send your developer

The check flags iframes with a src that are display:none, visibility:hidden, opacity:0, fully clipped, 10px or smaller in either dimension, or positioned off screen, excluding a list of common payment, analytics and widget hosts. The frame may be injected at runtime, so also search the database, look for scripts that call createElement('iframe'), and diff templates against a known-good deploy.

grep -rIl "suspicious-domain.example" public_html/
grep -rIl --include=*.php --include=*.js "createElement('iframe')" public_html/
wp db search "suspicious-domain.example" --all-tables

Common questions