I work locally with a WordPress site. When I logged in, it looked like the password was highlighted. It went very fast. Half a second maybe. I found it strange that it looked like it was marked, as in the image below.

The reason I am a bit vigilant is that I have a another site with a special login URL that only the owner of the site and I know about, but sometimes there are unknown login attempts there. Could my PC be hijacked? A trojan? How can I find out?

Screenshot of WordPress login with marked password.


No, it's not a virus. The following xkcd comic illustrates this well:


CC-BY-NC 2.5: Created by Randall Munroe, xkcd

As you can see, the events you described have nothing to do with a keylogger, a virus, a trojan or what InfoSec professionals generally refer to as "malware". If you really had a malware infection, you would not notice it, and all the security precautions such as "using a secret URL to log in" would be meaningless anyways.

So why was the password marked when you clicked login? God only knows, but malware does not need to "mark" a password to copy it.

As for the invalid login attempts you noticed, this is absolutely normal background noise on the internet.

| improve this answer | |
  • Thanks. You say: "If you really had a malware infection, you would not notice it, and all the security precautions such as 'using a secret URL to log in' would be meaningless anyways." And thats the reason why I wonder.... – fk76 Dec 2 '19 at 12:59
  • @fk76 My tip is not to worry about it. If you really need closure, back up your data and re-install your OS. – MechMK1 Dec 2 '19 at 13:10
  • The quote you mentioned is said since a malware infected system has so many capabilities to get informations. It can read your browser history, record your internet traffic, install keylogger and more. Having a secret URL is meaningless at that point since it will be a peace of cake for the hacker to find out. Additionally even if the URL is secret, the thousands of website crawlers out there will find it and that's why you have failed login attempts. As Mech mentioned it's normal internet noise. – Nico Dec 2 '19 at 15:10
  • @Nico A crawler can only find a website if it is referenced somewhere in publicly-accessible data. – MechMK1 Dec 2 '19 at 17:51
  • 1
    @Nico It depends how "secret" the url is. If it's, for example, example.com/login-bdee3af7-3125-48a5-8818-f65e7a55057a.php, and it is never referred to anywhere, then it's likely not on google. – MechMK1 Dec 3 '19 at 7:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.