What is a backdoor in WordPress?

A backdoor is code that lets an attacker get back into a site without the normal login. It can be a file that accepts commands, an extra administrator account, a scheduled task or a few lines hidden in a legitimate file. Its purpose is to survive cleanup.

How do I know if my WordPress site has a backdoor?

Common signs are PHP files in the uploads folder, unfamiliar files in mu-plugins, files that fail a core or plugin checksum, administrator accounts you did not create, and malware that returns after you remove it. Checking these from the server confirms it.

Will removing the malware also remove the backdoor?

Not necessarily. Malware you can see, such as spam pages or redirects, is often the result of the attack. The backdoor is what keeps the attacker in control, and it can sit in a different place, so it needs its own check.

Can a backdoor survive reinstalling WordPress?

Yes. Reinstalling core replaces only the core files. A backdoor in a plugin, a theme, the uploads folder, a server configuration file or the database usually survives, so the site can be taken over again.

Why does the malware keep coming back after I clean the site?

Almost always because a backdoor was missed or the original entry point, such as an outdated plugin or a stolen password, was never closed. Check mu-plugins, scheduled tasks and configuration files, and work out how the attacker got in.

What Is a WordPress Backdoor and How Do You Find One?

Most people clean a hacked site, see the spam gone, and move on. A week later it is back. Often the cause is a backdoor: a small piece of code the attacker planted so they could return at will, whatever you removed. If you have just cleaned a site, or the same infection keeps returning, this is the step you may have missed.

Before you look: make a full backup of the site as it is now, files and database. It is evidence, and it lets you undo a mistake. If you have not confirmed the site is hacked yet, start with the five-minute check.

What a backdoor is

A backdoor is any way back into a site that does not go through the normal login. It may be a file that accepts commands from the attacker, an extra administrator account, a scheduled task that downloads new malware, or a few lines hidden inside a legitimate file. What they share is purpose: they exist to survive your cleanup.

That is why deleting the spam pages or the redirect script alone rarely fixes a hack. Those are the symptoms. The backdoor is how the attacker keeps control.

Where backdoors hide

Attackers pick places that look normal or that people rarely open. These are the usual ones:

The uploads folder. It should hold media only. A PHP file in wp-content/uploads is almost never legitimate, and names like image.jpg.php are a common disguise.
The must-use plugins folder. Files in wp-content/mu-plugins load on every request, and they do not appear in the normal plugin list.
Fake or modified plugins and themes. A folder with a believable name that you never installed, or extra lines added to the end of functions.php in your active theme.
WordPress core folders. A stray file in wp-includes or wp-admin, often with a name that looks like a core file.
wp-config.php. Code placed above the first line or below the last one.
Server configuration files. An auto_prepend_file setting in .user.ini or php.ini runs a file before every page. Injected rules in .htaccess are another favorite.
Extra administrator accounts. An admin that you did not create, sometimes with an email address that looks like part of your own domain.
Scheduled tasks. A WordPress cron event that calls an unfamiliar function can recreate a deleted backdoor on schedule.
The database. Code stored in an option or a post, with a small loader elsewhere that runs it. A file scan never sees this.

How to look for backdoors

The commands below only read your site. Run them over SSH from the WordPress folder, usually public_html. They need WP-CLI, which most managed hosts include.

1. Compare core and plugin files with the official copies

wp core verify-checksums
wp plugin verify-checksums --all

Any file listed as changed, or as one that should not exist, deserves a look. Premium plugins that are not on wordpress.org cannot be checked this way.

2. Look for PHP files where there should be none

find wp-content/uploads -name "*.php"
ls -la wp-content/mu-plugins

Every result in uploads needs an explanation. Anything in mu-plugins that you did not add yourself is a strong warning sign.

3. Check what changed recently

find . -type f -name "*.php" -mtime -14

Compare the list with your own update history. A file changed on a day you did nothing, especially in a plugin folder you never touched, is worth opening.

4. Check accounts and scheduled tasks

wp user list --role=administrator
wp cron event list

Look for an administrator you do not recognize and for cron events with names you cannot place.

5. Read the configuration files

cat .htaccess
cat .user.ini
head -n 20 wp-config.php

The .htaccess file should contain only the standard WordPress rules and anything you added on purpose. .user.ini should not exist unless your host or you created it. In wp-config.php, nothing should appear before the opening line.

6. Search for suspicious functions, then read the file

grep -RIl --include="*.php" -E "eval\(|base64_decode\(" wp-content

These functions also appear in plenty of legitimate plugins, so a match is a lead, not proof. Open each file and read it. A backdoor usually combines such a function with input that comes from the visitor's request, which a legitimate plugin rarely does.

What a scanner can and cannot tell you

A scanner that matches known malware patterns catches many backdoors, but not custom ones, and it cannot prove a site is clean. Treat a clean result as good news, not as a guarantee, and keep checking over time.

What to do when you find one

Do not just delete it. Copy the file to a quarantine folder outside the web root so you can read it later. Then remove it from the site.
Close the way it got in. A backdoor is planted through something, usually an outdated plugin, a stolen password or a weak hosting login. If you leave that open, the attacker plants another one.
Change every credential. Hosting, SFTP and SSH keys, the database password, every WordPress administrator, and the security keys in wp-config.php. Do it in that order.
Replace, do not repair. Reinstall core, plugins and themes from clean copies, as described in How to Remove Malware From a WordPress Site.
Check again. Repeat the commands above after 24 hours and after a week. A file or administrator that returns means something was missed.

If the site holds customer data, or the infection keeps coming back despite all this, a specialist can rebuild the site from clean sources. That is slower, but it is the surest way to remove a backdoor you cannot find.

How SiftWP helps

SiftWP runs checks like these every week over SSH, with no plugin on your site. It looks at core file integrity, new files in uploads/, database changes and malware patterns, and an AI agent investigates each finding. Suspicious files are quarantined, never deleted, and anything risky waits for your approval.

Start with free credits, no card needed

What a WordPress backdoor is and how to find one