Fix today

Your page runs code that is deliberately scrambled

What it means

EverThread found a script written directly into your page that uses at least two tricks for hiding what it does. These tricks store the real code as encoded or scrambled text, unpack it while the page loads, and then run it or write it into the page, so the code you can see is not the code that actually runs.

This is different from "minified" code, which is squeezed onto one line to load faster. Minified code is hard to read but not hidden on purpose. Obfuscated code is scrambled so that someone looking at it cannot tell what it does.

Why it matters

Scrambling is how malicious code hides in plain sight. On hacked sites it is used for card skimmers that copy what shoppers type at checkout, redirects that send visitors to scam sites, hidden spam, and crypto-miners.

Some legitimate snippets trip this check too. Very old analytics and ad code often unpacked itself this way, and a few consent, testing and anti-bot tools encode their settings. So the finding is not proof of a hack, but it deserves a look today, especially if your site takes payments.

How to check your own site

1. Open the finding in your EverThread dashboard. Its details include the start of the script, which is often enough for your developer to recognize it.
2. View the page source (Ctrl+U, or Cmd+Option+U on a Mac) and search for the start of the script from your dashboard. Scrambled code stands out as a long block of random-looking letters and numbers. Note where it sits and what comes just before and after it. A service name in a nearby comment is a helpful clue.
3. Check whether it appears on every page or only some. A script only on checkout, cart or login pages is a strong warning sign.
4. Compare with an older backup, or ask your developer whether it was in the last version they delivered. Do not copy the code into your browser console to "see what it does". That runs it.

How to fix it

Any website

1. If your developer confirms it belongs to a tool you use, keep it and acknowledge the finding in your EverThread dashboard.
2. If nobody can identify it, treat the site as hacked. Back up the site as it is, then change every password tied to it: admin, hosting, FTP, database and the email used for resets. Remove admin users you do not know.
3. Remove the script, or restore a backup from before it appeared. Then find how it got in: usually an outdated plugin, theme or app, a reused password, or an old copy of the site left on the same hosting.
4. If your site takes card payments and the script appears on checkout pages, contact your payment provider and ask what they need from you. Bring in a professional for this case.
5. If Google flagged the site, request a review in Search Console under Security & Manual Actions, Security issues, once it is clean. The spam cleanup guide covers the full cleanup in more detail.

WordPress

1. Check where scripts get added site-wide: header and footer code plugins, theme settings, the Customizer and widgets.
2. Search your posts, pages and theme files for the start of the script. Injected code is often stored in the database, not in files.
3. Update WordPress, plugins and themes, and delete ones you do not use. Reinstall the current version under Dashboard, Updates to restore clean core files, and replace plugins with fresh copies from wordpress.org or the vendor.
4. Replace the security keys in wp-config.php with fresh ones to sign everyone out.

Shopify, Squarespace, Wix and other hosted builders

1. Check custom code: the theme code on Shopify (especially theme.liquid), Code Injection on Squarespace, and Custom Code in the Wix site settings. Menu names change, so search the help center if needed.
2. On Shopify, also review Customer events under Settings, where tracking pixels live, and your installed apps.
3. If you did not add it, change your password, turn on two-step verification, remove staff or collaborators you do not recognize, and contact platform support.

cPanel hosting

1. In File Manager, turn on "Show Hidden Files" in Settings, then sort by Last Modified to find recently changed files.
2. Look in Cron Jobs for tasks you did not create. Ask your host to search the files for the script if you cannot.

Cloudflare

1. Check Workers for code you did not write, and review the Audit Log for recent changes.
2. After cleaning, purge the cache under Caching, Configuration.

What to send your developer

The check flags inline scripts that combine two or more hiding techniques: decoding encoded strings at runtime, building strings from character codes, evaluating strings as code, writing markup into the document while it loads, dense hex escapes, or a long base64 run. Decode the script in an isolated environment, never on a production page. Then search the codebase, theme and database for the same script and for server-side backdoors that decode or decompress their payload, and diff against a known-good deploy.

Common questions