Attacks Dictionary
Webshell
Definition
A webshell is a small script uploaded to the server that lets an attacker run commands through the browser.
Also called: web shell, web-shell
Why it matters for WordPress
One PHP file in uploads or a theme can give full filesystem and database access. Attackers use webshells to plant more malware, steal dumps, or pivot to other sites on shared hosting.
How it shows up in practice
- PHP files under
wp-content/uploads - Tiny files with names like
x.php,1.php, or random strings - POST requests to odd paths in access logs
- File integrity alerts for new executable paths
What to do
- Block PHP execution in uploads at the server level when you can.
- Scan for unexpected PHP outside plugin/theme code.
- Review how the file got there (vulnerable form, plugin, FTP credentials).
- Remove the shell, close the entry point, rotate credentials.
- Compare core files so modified droppers are not missed.
In WP Security Ninja
Use the malware scanner to find suspicious PHP and the core scanner to catch unexpected changes to WordPress core files. After cleanup, keep scanning until findings stay clean.
Related terms
Nearby ideas in the dictionary
- Backdoor A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.
- Malware Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- File integrity monitoring File integrity monitoring checks whether important files changed compared with a known-good baseline.