What is an 'option' and why would malware live there?

wp_options is WordPress's settings table — the site URL, active plugins, and most plugin configuration live there. Malware targets it because several options render into every page or control where the site redirects, so one row grants site-wide effect with no file changes for a file scanner to see.

The flagged option is siteurl or home. What does that mean?

That is the classic full-site redirect hack: visitors (often only from search results, to hide from the owner) get forwarded to the attacker's domain. It also means whatever wrote it had database-level access. Fix the value, then treat the site as compromised — that write had to come from somewhere, usually a vulnerable plugin or stolen admin session.

Is it safe to edit the option directly?

Yes — via the database or WP-CLI (wp option update). Note the old value first for the record. If the flagged option belongs to a plugin, updating it may only hold until the plugin rewrites it, so identify the owning plugin and check whether it is the compromise vector before considering the fix durable.

Glossary · Malware

A malicious URL was found in a site option

Wordfence type: optionBadURL
Category: Malware
Severity: High

A value in the WordPress options table points at a known-bad domain.

Written by G. Schad, Cybersecurity Specialist Published 2026-07-31 · Updated 2026-08-22

The alert usually reads

Option siteurl contains a suspected malware URL.

What Wordfence found

Wordfence matched a URL stored in wp_options. Options hold settings for core, themes and plugins — including, on many sites, the home and siteurl values.

Why it matters

Options are a favourite place to hide a redirect, because nothing on the visible site looks wrong while every visitor is quietly sent elsewhere. Injected values in siteurl or home can also lock an administrator out of their own dashboard.

How to fix it

1Identify the option name from the finding before editing anything.
2If siteurl or home have been changed, correct them in wp-config.php first so you can log in.
3Remove or correct the offending value.
4Follow the database-injection steps — an option rewrite means something had database write access.

Common questions

What is an 'option' and why would malware live there?: wp_options is WordPress's settings table — the site URL, active plugins, and most plugin configuration live there. Malware targets it because several options render into every page or control where the site redirects, so one row grants site-wide effect with no file changes for a file scanner to see.
The flagged option is siteurl or home. What does that mean?: That is the classic full-site redirect hack: visitors (often only from search results, to hide from the owner) get forwarded to the attacker's domain. It also means whatever wrote it had database-level access. Fix the value, then treat the site as compromised — that write had to come from somewhere, usually a vulnerable plugin or stolen admin session.
Is it safe to edit the option directly?: Yes — via the database or WP-CLI (wp option update). Note the old value first for the record. If the flagged option belongs to a plugin, updating it may only hold until the plugin rewrites it, so identify the owning plugin and check whether it is the compromise vector before considering the fix durable.

How WPSecureOps treats it

The connector reports this as optionBadURL. WPSecureOps files it under Malware and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.

Primary references

Product behaviour and remediation guidance were checked against these primary sources.