What it is

The home page writes encoded content into itself via document.write — often used to smuggle a malicious script or redirect past a casual look at the page source.

How to fix it

Review the page's source for a script you don't recognize. If you're not sure, install the WordPress Plugin and run AI Repair to clean it safely (with an automatic backup and rollback).

In depth

Our security scan detected code on your website that uses a technique often associated with hacking attempts, where malicious instructions are written directly into your page's HTML in a hidden way. This type of code can redirect visitors to harmful websites, steal their personal information, or inject unwanted content into your site. You should remove this code immediately because it puts your visitors at risk and can damage your site's reputation with search engines. To fix it, log into your WordPress admin panel, go to Appearance, then Theme File Editor, and carefully search your active theme's files (particularly header.php and footer.php) for any unfamiliar document.write commands or suspicious code strings. If you're not comfortable editing code directly, contact your web hosting support or hire a WordPress developer to locate and remove the malicious code safely. After removal, run a fresh security scan to confirm the threat is gone and consider adding a security plugin that monitors file changes to prevent this from happening again.