WordPress backdoor removal: ending the reinfection loop
A backdoor is a way back into your site that doesn't depend on the original vulnerability or a valid password. If a cleaned WordPress site keeps getting reinfected, a backdoor is the first thing to suspect.
Backdoor detection and removal is part of our malware cleanup, from $199.
What a backdoor is, and why it causes reinfection
When an attacker gets into a WordPress site, their first job is usually to make sure they can get back in. They plant something that works independently of the way they entered: a small script, an extra administrator, a modified plugin. After that, even if you patch the original hole and change every password, the access is still there.
This is why a cleanup that removes only the visible symptom, such as the spam pages or the redirect, often "works" for days and then fails. The infection returns because the access was never removed. For the wider picture see why malware keeps coming back.
Places a backdoor can live
None of these is unusual. A thorough investigation checks every one of them, because missing one defeats the rest of the cleanup.
PHP files
Small files with innocuous names in uploads, plugin or theme folders, or the site root, often disguised as core or plugin files.
Modified plugins and themes
Code added to a genuine plugin or theme, so the file looks right at a glance. Inactive plugins and themes are often forgotten.
mu-plugins and drop-ins
Must-use plugins load automatically and don't appear in the normal plugin list, which makes them attractive hiding places.
Hidden administrators
Extra accounts with administrator rights, sometimes hidden from the user list by code, or named to look legitimate.
Scheduled tasks
WordPress cron events that periodically re-download or re-create the malicious code.
Database persistence
Executable code or loader instructions stored in options, posts or widgets, which survives a clean file replacement.
Server-level changes
Modified .htaccess or PHP configuration files that load code before WordPress starts.
Credential compromise
Stolen hosting, SFTP or database credentials, application passwords or session tokens that stay valid until rotated.
Detecting backdoors without guessing
Verify core and components against known-good copies
WordPress core files are compared with the official release, and plugin and theme files with their published versions, so any difference stands out.
Look for what shouldn't exist
Unknown PHP files, recently changed files in unexpected places, and files that don't belong in uploads.
Review users, cron and options
Every administrator and privileged user, every scheduled event, and options and content that contain code.
Read the logs
Where the host provides them, access and error logs show when and how the first access happened.
Remove, rotate and re-verify
Everything found is removed, credentials and keys are rotated, and the site is re-checked after a period of normal activity.
Backdoor FAQ
Can a scanner find every backdoor?
No. Scanners recognise known patterns. Custom or obfuscated code, database-resident code and rogue accounts can all be missed, which is why investigation includes more than a file scan.
I restored a backup. Shouldn't that remove it?
Only if the backup predates the compromise, and even then the vulnerable plugin is still there. See why restoring a backup may not fix a hacked site.
How do I know the backdoor is really gone?
We re-check after cleanup and report in writing. Nobody can prove a negative, so we also close the entry point and rotate credentials so any access that was missed stops working.
Tell us about your site
Send a short message: your website, what you're seeing, and who hosts it. We'll get back to you with next steps.