⚠️ Don't attempt to remove this yourself

If you suspect a malicious service worker or other breach, don't try to clean up files, plugins, or code yourself. Removing the wrong thing can make recovery harder and can destroy evidence we need to find how the site was compromised. Contact your Innermedia support team immediately instead.

What's happening

A service worker is a small script browsers can cache and run in the background for a site, even after the visitor has left. If a site is compromised, attackers can plant a malicious service worker that keeps redirecting visitors to spam or scam pages — sometimes even after the original infected code has been removed, because the browser keeps re-running the cached script.

⚠️ Warning signs

Visitors being redirected to unrelated or suspicious websites, pop-ups appearing that you didn't add, or a security scanner flagging your site as compromised.

What to do

  1. Reset your own WordPress user password straight away, and ask everyone else with a WordPress login on the site to reset theirs too.
  2. Contact your Innermedia support team straight away so we can scan for and remove any malicious files or code, including the rogue service worker registration, and unregister it so browsers stop running it for returning visitors.
  3. We’ll review plugins and user accounts for anything unfamiliar, and check core WordPress files are unmodified.
  4. We’ll update plugins, themes, and WordPress core to their latest versions to close the entry point that was used.
💡 Prevention

Keeping plugins and WordPress core up to date, using strong unique passwords, and enabling two-factor authentication on admin accounts are the most effective ways to prevent this happening again.