---
title: Webshell
canonical: https://wpsecurityninja.com/dictionary/webshell/
---
# Webshell

A webshell is a small script uploaded to the server that lets an attacker run commands through the browser.

[Full guide](https://wpsecurityninja.com/wordpress-backdoor-hacks-what-to-know/)

## Why it matters for WordPress

One PHP file in uploads or a theme can give filesystem and database access. Attackers use webshells to plant more malware, steal dumps, or pivot to other sites on shared hosting. Cleanup that misses the shell (or the upload hole) invites reinfection.

## How it shows up in practice

- PHP files under `wp-content/uploads`
- Tiny names like `x.php`, `1.php`, or random strings next to images
- POST requests to odd paths in access logs
- File integrity alerts for new executable paths outside plugins

## What to do

1. Block PHP execution in uploads at the server level when you can.
2. Scan for unexpected PHP outside normal plugin and theme code.
3. Trace how it got there (vulnerable form, plugin, FTP credentials).
4. Remove the shell, close the entry point, rotate credentials.
5. Compare core so modified droppers are not missed.

## In WP Security Ninja

Use the [malware scanner](https://wpsecurityninja.com/malware-scanner/) to find suspicious PHP and the [core scanner](https://wpsecurityninja.com/core-scanner/) to catch unexpected core edits. After cleanup, keep scanning until findings stay clean. Persistence patterns: [WordPress backdoor hacks](https://wpsecurityninja.com/wordpress-backdoor-hacks-what-to-know/).