Obfuscated JavaScript on Your Site: Malware, or Marketing Code From 2009?
A scanner just flagged a block of unreadable JavaScript in your theme. Before you panic (or delete it and break something), here's an uncomfortable truth from our own research: on older WordPress sites, the most common "obfuscated malware" finding isn't malware at all. It's marketing code that has been sitting there since the late 2000s.
When we audited large batches of sites that security tooling had flagged as infected, one pattern dominated the false alarms: a block of document.write(unescape('%3C%73%63%72...')) somewhere in a theme file or footer. It looks exactly like the kind of thing an attacker would plant. Scrambled text, a decoding function, code writing code into the page. Well over half of the "obfuscated script" flags we investigated in those audits turned out to be this, and none of them were malicious.
This post explains why legitimate code from that era looks so guilty, how to decode a suspicious block safely, and the four checks that separate a harmless relic from a live infection.
Why innocent code looks like malware
In the 2000s and early 2010s, the standard way vendors distributed embed snippets was exactly the pattern scanners now distrust. Three examples you will still find in the wild on long-lived sites:
- Old Google Analytics. The classic urchin-era snippet built its script tag with
document.write(unescape('%3Cscript...'))to safely choose between HTTP and HTTPS versions of the tracker. Millions of sites pasted it into themes and never touched it again. - Trust seals. Certificate vendors' "site secured" badges shipped as encoded
document.writeblocks, partly so the seal was harder to copy by hand. - Marketing and analytics tags. Early tag snippets from various marketing platforms used the same escape/unescape trick for quote-safety inside HTML.
The technique was never about hiding anything from humans. It was a workaround for browser and quoting limitations of the time. But structurally (encoded string, decoder, dynamic script injection) it is indistinguishable from the opening move of a malware injection, which is why pattern-matching scanners flag it two decades later.
Decode first, judge second
The single rule that prevents both missed infections and broken sites: never judge an encoded block without decoding it. The encoding is not the verdict; the payload is. Decoding a %xx-escaped string is safe and takes seconds: paste the escaped part into any URL-decoder (or your browser console's decodeURIComponent, without executing anything around it) and read what comes out.
What comes out is usually one of two things:
- A plain script tag pointing at a recognizable, long-established domain (an old analytics host, a certificate vendor, a marketing platform). That's a relic.
- Something that still isn't readable, chains into more decoding, or points somewhere you've never heard of. That's when you should worry.
This is how our pipeline treats the pattern, too. Any indicator that legitimate scripts also emit is never trusted on its own: the payload gets decoded and its actual destination verified before anything is called malware. A scanner that skips that step either deletes your old analytics tag or, worse, teaches you to ignore its warnings.
The four checks
For any scrambled script block a scan flags on your site, work through these in order:
- Decode the payload. URL-decode the escaped string and read the result. A single decoding layer that produces a clean script tag is the signature of legacy embed code. Real malware strongly prefers stacked layers: decode once and you find another encoded blob, an
eval, or character-code arithmetic. - Check the destination. If the decoded result loads a script, where from? A domain that has belonged to a known analytics, certificate, or marketing vendor for 15+ years is a very different answer than a domain registered recently, a raw IP address, or a URL full of random characters.
- Check the location and the date. Legacy snippets live where a human would paste them: a theme's footer or header file, a "custom scripts" widget, sometimes copied across every theme the site ever used. Malware favors places no human edits: core WordPress files,
wp-includes, freshly changed files on a site nobody was updating. A file untouched for eight years is telling you something; so is one modified last week. - Check for company. A lone legacy tag is normal. The same block suddenly present in dozens of files, or appearing alongside other recent changes (new admin users, unfamiliar plugin folders, modified core files), stops being a relic and starts being a campaign.
What the real thing looks like
For contrast, the obfuscated injections we confirm as malicious in cleanups tend to share traits the relics never have: multiple encoding layers ending in eval or dynamically built function calls; destinations that rotate across scans; injection into files the owner has no reason to edit; and a payload that does something no marketing tag does, like redirecting visitors, loading further scripts conditionally based on who is looking, or writing cookies that suppress the payload on repeat visits so the owner never sees it.
That last trick matters: a lot of modern injection malware deliberately hides from the site's own operator. If visitors report spam or redirects that you cannot reproduce, believe them, not your own browser.
The honest takeaway
Obfuscation is a hint, not a conviction. Treating every encoded block as malware produces cleanups that delete twenty-year-old analytics tags while missing the actual backdoor two folders over. Treating none of them as malware is how sites stay infected for months. The only reliable path is the boring one: decode, verify the destination, weigh the context.
Kornet's scanner does exactly that across every file on your site and your database, and shows you what it concluded and why in a full report. The scan is free; you only pay if we actually find malware.
Kornet Labs publishes field notes from real WordPress malware cleanups and from the false-positive audits we run against our own detection pipeline.