Backdoor
A backdoor is code or configuration left on a system that lets an attacker regain access after the original entry point is closed.
Updated 2 Sept 2026
In more detail
On web platforms a backdoor is typically a small file that accepts commands over HTTP — a web shell — but it can equally be an extra administrator account, a modified core file, a scheduled task, an SSH key, or a plugin that looks legitimate. Backdoors are what turn a one-off intrusion into persistent access, and they are the reason cleanups fail: removing injected spam without removing persistence means the spam returns, often within hours.
Why Backdoor matters
Persistence changes the shape of the incident. A site owner who deletes spam files and changes a password has not ended the compromise; the attacker still has a way in and can re-inject at will. CISA's incident guidance treats eradication of persistence as a distinct phase from removing the visible payload for exactly this reason.
How it works
Common web backdoors accept a parameter containing base64-encoded or otherwise obfuscated PHP and pass it to an evaluation function, so a single small file provides full file and database access. Attackers hide them in writable directories such as uploads, name them after real platform files, and often plant several so removing one is not enough.
Examples
- An obfuscated PHP file in wp-content/uploads/ that executes commands sent as a POST parameter.
- An unexpected administrator account created days before spam pages appeared.
- A modified theme functions file that re-downloads the payload from a remote host on every request.
How it is detected or measured
Compare the file tree against a known-good deployment or version control, look for recently modified files with unexpected timestamps, review all privileged accounts and API keys, inspect scheduled tasks, and check for outbound requests to unfamiliar hosts in server logs.
Frequently asked questions
- Does restoring a backup remove a backdoor?
- Only if the backup predates the compromise and the original entry point has been patched. Restoring a backup taken after the intrusion re-installs the backdoor, and restoring a clean backup onto an unpatched platform invites the same attack again.
Where this matters
- How to Check if a Website Is Hacked
Eight checks that reliably separate a compromised site from a slow or misconfigured one, in the order that finds problems fastest.
- How to Remove Injected Spam Links
Removing injected outbound links without breaking your templates — and making sure they do not come back on the next cache rebuild.
- Website Security Checklist
A prioritised checklist covering access, patching, backups, monitoring and response — ordered by how much risk each control removes.
Sources
- Web shell malware continues to evade detection — CISA / NSA
How web shells are deployed, hidden and detected.
- Computer Security Incident Handling Guide (SP 800-61) — NIST
Containment, eradication and recovery as separate phases.