A WordPress backdoor is designed to survive cleanup. It gives an attacker a quiet way back into the website after spam pages, redirects or obvious malware have been removed. Some backdoors are short PHP files; others are hidden inside legitimate plugins, scheduled tasks, database options or stolen administrator access.
If the same infection keeps returning, treat it as an incident with persistence—not a single bad file. Start with the broader symptoms in 10 signs your WordPress site has been hacked and preserve evidence before making destructive changes.
Book a free, no-obligation strategy call and we'll map out your next move.
What a WordPress backdoor can do
A backdoor may create administrators, reinstall malware, inject links, redirect visitors, exfiltrate data or open a remote command channel. Sophisticated versions run only for particular cookies, IP addresses, referrers or user agents, so the site can look normal to its owner.
A clean scan is therefore encouraging, not conclusive. The goal is to understand how the attacker entered, where persistence exists and whether the wider hosting environment is affected.
Before you investigate
- Take a complete snapshot of files and the database and store it away from the public server.
- Export available hosting, authentication, firewall and application logs.
- Record suspicious files, timestamps, users, URLs and error messages.
- Use a staging copy or isolated environment for examination whenever possible.
- Coordinate with the host before deleting accounts or server tasks that may be evidence.
Use the WordPress security audit checklist to build a consistent inventory of users, software, backups and controls.
Step 1: establish a trusted baseline
Identify the exact WordPress version and every installed plugin and theme. Obtain fresh packages from WordPress.org or the original vendor. Compare core files and extension directories against those trusted copies. A modified file is not automatically malicious, but unexplained differences deserve review.
Do not rely only on modification dates. Attackers can preserve or manipulate timestamps, while legitimate updates change many files at once. Combine hashes, content comparison, ownership, permissions and log evidence.
Step 2: inspect high-risk locations
- Must-use plugins and drop-in files that load automatically.
- Active and inactive theme functions, template files and custom code snippets.
- The uploads directory, which normally should not contain executable PHP.
- wp-config.php, the root index file and web-server rewrite configuration.
- Cache, backup and temporary directories that may still be web-accessible.
- Sibling websites and shared hosting directories.
Look for unfamiliar includes, encoded or heavily obfuscated strings, code that executes request parameters, unexpected remote calls and conditional behavior. Context matters: compressed vendor code can look unusual without being malicious.
Step 3: check users, sessions and application passwords
Compare all privileged accounts with an approved owner list. The detailed rogue WordPress administrator guide explains how to preserve evidence, check outside the dashboard and remove malicious access safely.
Revoke unknown application passwords, integrations and active sessions. If a legitimate administrator may be compromised, secure that person’s email and device before resetting the WordPress password.