PHP backdoors leave a hidden way back into a website.

A PHP backdoor is code planted on a website to preserve access after the first break-in. It can sit in a standalone webshell, a plugin, a theme or an injected WordPress hook, then act when a request, login or scheduled task reaches it.

compromised website
  -> planted PHP file, plugin or hook
  -> hidden request, login event or scheduled poll
  -> administrator session, credential log or file change
  -> backdoor remains in the site for the next request

Webshells and backdoor loaders

A webshell exposes a request-driven action through a PHP file. A backdoor loader can blend into WordPress and ask a controller for work. The loader code we match can execute supplied PHP, write files and restore itself through scheduled events and theme injections.

Small hooks can provide the same lasting access. One matched backdoor accepts a URL parameter, selects an administrator or editor and grants a logged-in session. Another plugin creates an administrator, hides both the plugin and user, then sends the new credentials to a remote endpoint.

Hidden accounts and password logs

A hidden WordPress administrator can disappear from several views at once. The code we detect filters user queries, the REST API, XML-RPC, user sitemaps, the administrator list and the displayed account count. Checking only the Users screen can miss it.

We also match an authentication hook that records successful WordPress usernames and passwords in a file disguised as an image upload. The website can keep working normally while each valid login adds another line.

What we see across infected sites

Month	New sites
September	774
October so far	31

57% of the PHP-backdoor sites captured since 25 September run WordPress. Of those, 56% run WordPress 7.1. Of the 7 sites recaptured at least 25 days after their first match, 4 still served PHP-backdoor code (57%).

Finding and removing the planted code

Compare the entire site with trusted releases and a known-good deployment. Check:

• WordPress core, plugins, themes and must-use plugins for added PHP
• uploads for PHP files or files whose contents do not match their extension
• scheduled events, theme files, wp-config.php and server configuration
• administrator and capability records directly in the database
• plugins that disappear from the normal plugin list
• login hooks that write usernames or passwords into uploads
• unexpected PHP source printed into an HTML response

Remove every copy of the backdoor and restore changed files from trusted sources. Review site and hosting users, rotate WordPress and hosting credentials, invalidate active sessions, clear caches and inspect adjacent sites under the same hosting account.