A backdoor is any mechanism that lets an attacker regain access without going through the original vulnerability or a valid login. It is the reason "I cleaned it and it came back" is so common. This guide explains the categories defensively, so you know what a thorough cleanup has to check.
Why attackers install them
Getting in once may depend on luck: an unpatched plugin, a leaked password. Attackers don't want to rely on luck twice. After the first compromise, they add access that survives a password change and a plugin update.
The main persistence categories
Files
Small PHP files placed in writable folders, commonly uploads, plugin and theme folders or the site root, given names that imitate core or plugin files. A single request to such a file gives the attacker control. Because files in uploads shouldn't be executable PHP in the first place, find wp-content/uploads -name "*.php" is a good first check.
Modified legitimate files
The same effect with less visibility: extra code added inside a real plugin, theme or core file. Comparing files with the official copies (wp core verify-checksums for core) exposes these.
Must-use plugins and drop-ins
Files in wp-content/mu-plugins and drop-in files such as wp-content/db.php load without being activated, and don't appear in the normal plugin list.
Users
Additional administrator accounts, sometimes hidden from the user list with code. Review the users table directly. See Unknown Admin User in WordPress: What to Do.
Scheduled tasks
WordPress cron events can re-fetch or re-create the malicious code on a schedule, so the cleanup appears to work until the next run. wp cron event list shows what is scheduled.
Database
Code or loader instructions stored in options, posts or widget content. Replacing files alone never touches these.
Server-level configuration
Changes to .htaccess or PHP configuration files that cause code to load before WordPress itself.
Credentials and sessions
Not code at all: stolen passwords, SFTP/SSH keys, database credentials, application passwords and still-valid sessions. These are backdoors in effect, and they need rotating, not deleting.
Why one missed item is enough
Each mechanism can restore the others. A hidden file can recreate the rogue admin, and the admin can reinstall the plugin that recreates the file. A partial cleanup resets the clock but not the problem.
Defensive habits that reduce the risk
- Keep core, plugins and themes updated and remove what you don't use.
- Disable PHP execution in the uploads directory where your server allows it.
- Limit who is an administrator, and use two-factor authentication.
- Keep file integrity and new-administrator alerts on, so a change is noticed.
- Keep verified, off-server backups from before the incident.
For what a full investigation covers, see the backdoor removal page and the WordPress Malware Cleanup Checklist. If it keeps happening, malware removal includes persistence detection and a root-cause review, from $199. The wider process is in the The Complete WordPress Hacked Site Recovery Guide.
Further reading
Dealing with this on a live site?
Send us the details and we'll tell you what we'd do and what it would cost.