Drive-by malware infects a visitor’s device simply by loading a compromised page — no click or download required — typically by exploiting an unpatched vulnerability in the visitor’s browser or a plugin like an outdated PDF viewer.
How sites end up hosting it
- A vulnerable plugin, theme, or CMS core lets an attacker inject malicious script
- A compromised third-party ad network or embedded widget serves it without the site owner’s knowledge
- Compromised hosting credentials are used to directly modify site files
Protecting visitors and your site
- Keep all software (CMS, plugins, themes, server OS) patched promptly
- Use a web application firewall to filter known exploit patterns
- Regularly scan for injected/obfuscated JavaScript, which is the most common delivery method
- Vet third-party ad networks and embedded scripts before adding them
FAQ
Can visitors get infected without downloading anything?
Yes — that’s the defining feature of drive-by malware; simply loading the compromised page is enough if the visitor’s browser/plugins have an exploitable vulnerability.