Webshell
Definition
A webshell is a small script uploaded to the server that lets an attacker run commands through the browser.
Also called: web shell, web-shell
Why it matters for WordPress
One PHP file in uploads or a theme can give filesystem and database access. Attackers use webshells to plant more malware, steal dumps, or pivot to other sites on shared hosting. Cleanup that misses the shell (or the upload hole) invites reinfection.
How it shows up in practice
- PHP files under
wp-content/uploads - Tiny names like
x.php,1.php, or random strings next to images - POST requests to odd paths in access logs
- File integrity alerts for new executable paths outside plugins
What to do
- Block PHP execution in uploads at the server level when you can.
- Scan for unexpected PHP outside normal plugin and theme code.
- Trace how it got there (vulnerable form, plugin, FTP credentials).
- Remove the shell, close the entry point, rotate credentials.
- Compare core so modified droppers are not missed.
In WP Security Ninja
Use the malware scanner to find suspicious PHP and the core scanner to catch unexpected core edits. After cleanup, keep scanning until findings stay clean. Persistence patterns: WordPress backdoor hacks.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Backdoor A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.
- Malware Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- File integrity monitoring File integrity monitoring checks whether important files changed compared with a known-good baseline.
- File upload vulnerability A file upload vulnerability lets an attacker place a dangerous file on the server, often leading to a webshell.
