---
title: Backdoor
canonical: https://wpsecurityninja.com/dictionary/backdoor/
---
# Backdoor

A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.

Last updated: 2026-08-26

Also called: back door, backdoors

## Related terms

- [Webshell](https://wpsecurityninja.com/dictionary/webshell/): A webshell is a small script uploaded to the server that lets an attacker run commands through the browser.
- [Malware](https://wpsecurityninja.com/dictionary/malware/): Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- [Privilege escalation](https://wpsecurityninja.com/dictionary/privilege-escalation/): Privilege escalation is gaining higher access than intended, such as a subscriber becoming an administrator.
- [Nulled plugin](https://wpsecurityninja.com/dictionary/nulled-plugin/): A nulled plugin is an unauthorized, usually modified copy of a paid plugin that often includes malware or backdoors.
- [File upload vulnerability](https://wpsecurityninja.com/dictionary/file-upload-vulnerability/): A file upload vulnerability lets an attacker place a dangerous file on the server, often leading to a webshell.

[Full guide](https://wpsecurityninja.com/wordpress-backdoor-hacks-what-to-know/)

## Why it matters for WordPress

Cleaning “the obvious malware file” while leaving a backdoor means reinfection days later. Backdoors hide in themes, mu-plugins, uploads with double extensions, or database options that eval code on every request.

## How it shows up in practice

- Reinfection after a “successful” cleanup
- Unknown PHP files with obfuscated names
- Admin users or scheduled tasks that reappear
- File changes when nobody is editing the site

## What to do

1. Assume multiple persistence mechanisms until proven otherwise.
2. Diff core and popular themes/plugins against clean copies.
3. Audit users, cron, mu-plugins, and `wp-config.php`.
4. Rotate credentials and invalidate sessions after cleanup.
5. Keep an events log so the next odd admin create is visible.

## In WP Security Ninja

Scan with the [malware scanner](https://wpsecurityninja.com/malware-scanner/), then use the [Events Logger](https://wpsecurityninja.com/events-logger/) to catch new admins, plugin installs, and other odd changes if something tries to come back. Persistence deep dive: [WordPress backdoor hacks](https://wpsecurityninja.com/wordpress-backdoor-hacks-what-to-know/).