Glossary · Malware
A malicious URL was found in a site option
- Wordfence type
optionBadURL- Category
- Malware
- Severity
- High
A value in the WordPress options table points at a known-bad domain.
What Wordfence found
Wordfence matched a URL stored in wp_options. Options hold settings for core, themes and plugins — including, on many sites, the home and siteurl values.
Why it matters
Options are a favourite place to hide a redirect, because nothing on the visible site looks wrong while every visitor is quietly sent elsewhere. Injected values in siteurl or home can also lock an administrator out of their own dashboard.
How to fix it
- 1Identify the option name from the finding before editing anything.
- 2If siteurl or home have been changed, correct them in wp-config.php first so you can log in.
- 3Remove or correct the offending value.
- 4Follow the database-injection steps — an option rewrite means something had database write access.
How WPSecureOps treats it
The connector reports this as optionBadURL. WPSecureOps files it under
Malware and bands it by the numeric severity Wordfence
assigns, so findings of this kind from every site you manage arrive in one queue rather
than one email per site. Titles and descriptions are stripped of HTML and the site's
absolute path is replaced before anything leaves the server.