ClickFix is deception that asks you to perform a harmful action yourself, disguised as a check or repair.
Definition source: Microsoft: Think before you Click(Fix). Read on 24 October 2026. The practical questions on this page help you define the issue with your administrator.
What is the prompt trying to achieve?
The page presents a problem and asks you to carry out its supposed solution. Microsoft describes ClickFix as social engineering: deception that exploits people’s inclination to solve an error or verification task. A familiar logo or convincing window does not establish that the instruction comes from the organisation shown.
A genuine visitor check such as TurnstileTurnstile is Cloudflare's privacy-friendly check that tells real people from bots on your forms, without making visitors solve puzzles. serves a different purpose. Stop if a page asks you to carry out unfamiliar instructions outside the website. A visitor should not need to perform an unexplained system action to help a site owner repair a fault.
This explanation therefore does not reproduce steps from deceptive prompts.
How can you distinguish it from an ordinary error?
Which PHP version does your site report?
We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.
Focus on the requested action. A page directing you to a system window to run something unfamiliar asks for something different from a form identifying a missing field. Urgency and branding do not make that instruction trustworthy.
Do not follow it solely because its appearance seems familiar.
Record the URL and describe what you saw without trying the action afterward. For an administrator, the report is an indicator of compromiseAn indicator of compromise is a technical observation that may point to an attack or unauthorized access to a system. that may need investigation. The report alone does not establish how the prompt reached that page or which system is affected.
What should visitors and administrators do?
As a visitor, close the suspicious page and contact the organisation through a known channel if needed. If you already performed the requested action, have your IT administrator assess the device. Explain what you did and when.
Do not limit the report to the website: the device may need a separate investigation.
As a site owner, ask the reporter for the page and time. Have your administrator determine whether the prompt came from your website, an external delivery or another source. A supply chain attackA supply chain attack reaches you through a supplier or supplied component, rather than only through your own website. is one possible investigation topic, not a conclusion established by a screenshot.
When is help needed?
Seek help when someone has followed the instructions or visitors report the prompt on your website. Have the people responsible for the website and devices agree which records are needed. Do not share passwords or copy suspicious instructions into an ordinary support form.
A PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. change does not automatically explain a deceptive window shown to a visitor. Separate website recovery, review of external content and assessment of the device. For each part, ask what has been established and who owns any open question.
A visible prompt disappearing does not answer all of those questions.
Product and company names on this page belong to their respective owners. We use them to describe the subject. We are not affiliated with those parties.
Prepare your request for help
Write a short note for your administrator naming the page, the time of the observation and what your team changed beforehand. Include the original warning if one is available. Keep facts separate from suspicions.
Describing what you saw on a particular page is more useful than stating a conclusion that has not been investigated.
For routine maintenance of a PHP site, review the existing PHP services. First discuss which question fits the service. This glossary page explains a term; it does not examine your installation or promise recovery.
For a possible incident, establish the expertise needed and which components someone can actually assess before agreeing the work.
Agree who receives the findings and who follows up an open question. Request a report identifying the areas checked, the date and the limitations. That helps you decide on a next step without treating general reassurance as evidence.
Your own first step is to record the observation and pass it to the administrator responsible for the site.
Frequently asked questions
Does seeing a ClickFix prompt mean my computer is infected?
Seeing the prompt alone does not establish that. Tell your IT administrator whether you performed the requested action. That distinction matters when assessing your device.
What should I tell my administrator?
Provide the page, time and original warning. Describe what you observed and what remains a suspicion. Do not submit passwords, keys or customer personal information through an ordinary contact form.
Can the PHP Exposure Check establish this?
No. It reports public information such as the PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. exposed by your server. It does not investigate malware, access permissions or interception of form input.
Have your specific warning assessed separately.