Attacks Dictionary
Backdoor
Definition
A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.
Also called: back door, backdoors
Why it matters for WordPress
Cleaning “the obvious malware file” while leaving a backdoor means reinfection days later. Backdoors hide in themes, mu-plugins, uploads with double extensions, or database options that eval code.
How it shows up in practice
- Reinfection after a “successful” cleanup
- Unknown PHP files with obfuscated names
- Admin users or scheduled tasks that reappear
- File changes when nobody is editing the site
What to do
- Assume multiple persistence mechanisms until proven otherwise.
- Diff core and popular themes/plugins against clean copies.
- Audit users, cron, mu-plugins, and
wp-config.php. - Rotate credentials and invalidate sessions after cleanup.
- Keep an events log so the next odd admin create is visible.
In WP Security Ninja
Scan with the malware scanner, then use the Events Logger to catch new admins, plugin installs, and other odd changes if something tries to come back.
Full guide: WordPress backdoor hacks.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Webshell A webshell is a small script uploaded to the server that lets an attacker run commands through the browser.
- Malware Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- Privilege escalation Privilege escalation is gaining higher access than intended, such as a subscriber becoming an administrator.