Glossary · Malware
A malicious URL was found in a post
- Wordfence type
postBadURL- Category
- Malware
- Severity
- High
Published post content links to a known-bad domain.
Post "Summer Sale 2024" contains a suspected malware URL.
What Wordfence found
A URL inside a post or page matches Wordfence's blocklist. The finding names the post.
Why it matters
Post content is normally only writable by authenticated users, so a malicious link in a post is a stronger signal than one in a comment. Either an account is compromised or something is writing to the database directly — and the link is being served to every visitor of that page.
How to fix it
- 1Open the post and check its revision history to see who or what introduced the link.
- 2If no legitimate revision explains it, treat the site as compromised.
- 3Remove the link, then check whether other posts contain it.
- 4Review administrator and editor accounts for ones you do not recognise.
Common questions
- How did a bad URL get into a post?
- Three routes, in rising order of severity: an author linked to a domain that later turned malicious; a contributor account was compromised and edited the post; or an injection wrote into post content through a vulnerable plugin. The post's revision history in WordPress distinguishes them — a link present since first publication tells a very different story from one added last Tuesday by an account that should not edit that post.
- Can I just delete the link and move on?
- If revisions show it was an innocent link to a since-compromised domain, yes. If the link was added by an account or process you cannot explain, the link is evidence, not the problem — check that account's other edits, reset its credentials, and look at what else changed on the site around the same timestamp.
- Does a bad outbound link hurt my search ranking?
- Linking to known-malicious destinations can get pages demoted or flagged, and if Google concludes the site is compromised the damage extends site-wide. It is not the SEO catastrophe a Safe Browsing listing is, but it is the same road. Clean it before crawlers make their own judgement.
How WPSecureOps treats it
The connector reports this as postBadURL. WPSecureOps files it under
Malware and bands it by the numeric severity Wordfence
assigns, so findings of this kind from every site you manage arrive in one queue rather
than one email per site. Titles and descriptions are stripped of HTML and the site's
absolute path is replaced before anything leaves the server.
Primary references
Product behaviour and remediation guidance were checked against these primary sources.