The URL is in my theme. Did my theme vendor do this?

Rarely. More often the theme file was modified after installation — footer.php is a favourite injection point because it renders on every page. Compare the file against a fresh copy of the same theme version. Nulled (pirated) themes are the exception: those frequently ship with malicious URLs already embedded.

The linked domain looks harmless or even dead. Still a problem?

Yes, twice over. First, blocklisted domains rotate — parked today, weaponised tomorrow, and the link on your site is already in place. Second, your presence on the linking side is evidence something modified your content, and that mechanism matters more than the current state of the destination.

Could this be a link an author added innocently years ago?

Possibly — domains get compromised or expire and turn hostile after a legitimate link was made. Check the page's revision history: an old, human-authored link to a since-ruined domain just needs removing. A link nobody added, or one hidden in markup no author touches, is an injection.

Glossary · Malware

A blocklisted URL was found in site content

Wordfence type: blacklistedURL
Category: Malware
Severity: High

Content on the site links to a domain known for malware or fraud.

Written by G. Schad, Cybersecurity Specialist Published 2026-07-31 · Updated 2026-08-22

The alert usually reads

File contains suspected malware URL: wp-content/themes/example/footer.php

What Wordfence found

Wordfence found a URL in the site's content that appears on a blocklist of known-malicious destinations. It may be in a post, a widget, or a theme file.

Why it matters

Links to malicious domains are how injected SEO spam and malvertising monetise. Their presence usually means something wrote to your content, not that an author made a mistake — and search engines will act on it.

How to fix it

1Locate the URL and establish whether a human added it.
2If not, treat this as an injection and follow the database-injection steps.
3Remove the link and re-scan.
4Check whether the same URL appears across multiple sites you manage — injections are usually campaign-wide.

Common questions

The URL is in my theme. Did my theme vendor do this?: Rarely. More often the theme file was modified after installation — footer.php is a favourite injection point because it renders on every page. Compare the file against a fresh copy of the same theme version. Nulled (pirated) themes are the exception: those frequently ship with malicious URLs already embedded.
The linked domain looks harmless or even dead. Still a problem?: Yes, twice over. First, blocklisted domains rotate — parked today, weaponised tomorrow, and the link on your site is already in place. Second, your presence on the linking side is evidence something modified your content, and that mechanism matters more than the current state of the destination.
Could this be a link an author added innocently years ago?: Possibly — domains get compromised or expire and turn hostile after a legitimate link was made. Check the page's revision history: an old, human-authored link to a since-ruined domain just needs removing. A link nobody added, or one hidden in markup no author touches, is an injection.

How WPSecureOps treats it

The connector reports this as blacklistedURL. WPSecureOps files it under Malware and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.

Primary references

Product behaviour and remediation guidance were checked against these primary sources.