---
title: Backdoor
canonical: https://wpsecurityninja.com/dictionary/backdoor/
---
# Backdoor

A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.

[Full guide](https://wpsecurityninja.com/wordpress-backdoor-hacks-what-to-know/)

## Why it matters for WordPress

Cleaning “the obvious malware file” while leaving a backdoor means reinfection days later. Backdoors hide in themes, mu-plugins, uploads with double extensions, or database options that eval code on every request.

## How it shows up in practice

- Reinfection after a “successful” cleanup
- Unknown PHP files with obfuscated names
- Admin users or scheduled tasks that reappear
- File changes when nobody is editing the site

## What to do

1. Assume multiple persistence mechanisms until proven otherwise.
2. Diff core and popular themes/plugins against clean copies.
3. Audit users, cron, mu-plugins, and `wp-config.php`.
4. Rotate credentials and invalidate sessions after cleanup.
5. Keep an events log so the next odd admin create is visible.

## In WP Security Ninja

Scan with the [malware scanner](https://wpsecurityninja.com/malware-scanner/), then use the [Events Logger](https://wpsecurityninja.com/events-logger/) to catch new admins, plugin installs, and other odd changes if something tries to come back. Persistence deep dive: [WordPress backdoor hacks](https://wpsecurityninja.com/wordpress-backdoor-hacks-what-to-know/).