Find and Close a Backdoor in Hacked WordPress

If malware keeps coming back after cleanup, there is usually a hidden backdoor somewhere on the site. You remove the redirect, the spam pages, the obvious infected file. Everything looks fine for a few days. Then the same problem shows up again, sometimes worse than before.

A WordPress backdoor is a hidden access point that lets an attacker return after the visible malware has been removed. It can be a malicious PHP file, a modified plugin or theme file, a hidden administrator account, a web shell, a suspicious database entry, or a server-level access issue. Finding and closing it is what actually stops the reinfection, not just cleaning up what’s visible on the surface.

This guide explains how to find and remove WordPress backdoors safely using SiteFort, without publishing exploit code or attacker-ready examples.

If you’re dealing with a broader malware incident, start with our complete guide on how to remove malware and clean a hacked WordPress site with SiteFort. This article focuses specifically on backdoors and reinfection.

Signs Your WordPress Site May Still Have a Backdoor

The clearest sign of a backdoor is reinfection. You clean the site, and the same problem comes back later. That usually means the attacker still has a way in, or an automated script is quietly recreating the malicious files on a schedule.

Common warning signs include:

• Malware returns after cleanup
• Deleted suspicious files reappear
• Unknown admin users keep coming back
• Redirects return after being removed
• New PHP files appear inside uploads
• Theme or plugin files change again after repair
• Search spam pages keep getting generated
• Hosting malware warnings continue after cleanup
• Unexpected login activity appears in audit logs
• Firewall logs show repeated probing for the same files

Not sure whether the site is hacked in the first place? Read our guide on 12 warning signs your WordPress site has been hacked.

What Is a WordPress Backdoor?

A WordPress backdoor is a hidden method of access an attacker leaves behind after compromising a site, specifically so they can get back in without exploiting the original vulnerability a second time. That’s why a hacked site can look clean for hours or days, then suddenly show the same redirect, spam pages, or malicious scripts all over again.

Backdoors show up in a range of forms, including:

• Unknown PHP files in uploads or writable folders
• Modified plugin or theme files
• Modified WordPress core files
• Malicious code hidden in functions.php
• Unexpected files in mu-plugins
• Hidden or unexpected administrator accounts
• Injected database content or suspicious options
• Malicious rewrite rules or redirect handlers
• Compromised SFTP, hosting, or control panel access

A proper cleanup has to remove both the visible malware and the backdoor letting it come back. If you want a closer look at the specific code patterns and named backdoor types attackers use, our guide on unmasking common WordPress backdoor scripts breaks those down in more depth.

Why Backdoor Malware Is So Hard to Fully Remove

Backdoors are dangerous because they can survive a partial cleanup. A site owner might remove a visible redirect script but miss the hidden file recreating it. Or they might replace infected theme files while an unknown administrator account stays active. Either way, the site is compromised again within days.

A backdoor can let an attacker:

• Upload new malware
• Create new admin users
• Modify files again
• Inject spam into posts or pages
• Redirect visitors
• Send spam email
• Steal configuration data
• Hide from basic scans

Backdoor removal isn’t an optional extra step. It’s the part of a cleanup that actually determines whether the fix holds.

Step 1: Run a SiteFort Security Scan

Start by scanning the site from inside WordPress with SiteFort.

SiteFort checks for malware, backdoors, web shells, injected scripts, SEO spam, suspicious redirects, hidden administrator risks, weak or breached passwords, vulnerable plugins and themes, exposed sensitive files, unsafe database and content indicators, and weak hardening rules.

Work through the highest-risk findings first:

• Backdoors and web shells
• Modified WordPress core files
• Unknown PHP files in uploads
• Suspicious plugin or theme changes
• Hidden administrator risks
• Suspicious content or database indicators
• Vulnerable plugins and themes
• Exposed backups, logs, config files, or debug files

Step 2: Check File-Based Backdoors

File-based backdoors are the most common source of WordPress reinfection. They tend to hide in locations where attackers can write files freely, and where site owners rarely check by hand.

Common locations include:

• wp-content/uploads/
• wp-content/mu-plugins/
• wp-content/plugins/
• wp-content/themes/
• wp-includes/
• Cache folders
• Temporary folders
• Backup folders
• WordPress root files

When you’re checking these locations, treat any of the following as worth investigating:

• Unknown PHP files in uploads
• Recently created files in writable folders
• Unexpected include or require statements
• Obfuscated or encoded code
• Web shell behavior
• Suspicious redirect logic
• Files that reappear after deletion
• Unexpected files inside mu-plugins
• Theme or plugin files modified outside normal updates

Let SiteFort’s findings decide whether a file gets repaired, restored, quarantined, deleted, or reviewed by hand.

Step 3: Repair File Integrity Issues

Modified WordPress core files are a serious warning sign. Core files should match the official WordPress release exactly. A backdoor injected into a core file can load early in the request cycle and keep quietly recreating malware, which is part of why this type of infection is so persistent.

When SiteFort reports file integrity issues, repair or restore the supported files instead of manually editing suspicious code line by line.

Depending on the finding, this can mean:

• Repairing modified WordPress core files
• Restoring clean plugin files
• Restoring clean theme files
• Replacing infected files with trusted versions
• Quarantining suspicious files before deletion

For custom code or unsupported premium software, compare the finding against a clean copy from the original developer or vendor before removing anything.

Step 4: Check Plugin and Theme Backdoors

Plugins and themes are a favorite hiding spot for backdoors, especially on sites running outdated, abandoned, or nulled software.

Pay close attention to:

• Recently modified plugin files
• Unknown plugin folders
• Suspicious files inside inactive plugins
• Theme functions.php changes
• Unexpected code in header.php or footer.php
• Old ZIP files or backups stored publicly
• Nulled or pirated plugins and themes

If SiteFort flags a WordPress.org plugin, update or reinstall it from the official repository. For premium plugins or themes, pull a clean copy from the original vendor. For nulled software, remove it entirely and replace it with a legitimate version, since there’s no clean file to restore from in the first place.

Deactivating a suspicious plugin isn’t the same as removing it. If it’s untrusted or unnecessary, delete it.

Step 5: Check Uploads and Writable Directories

The uploads folder should hold media files, not executable PHP. Any PHP file sitting in there is worth a second look on its own.

If SiteFort flags PHP files or suspicious scripts inside uploads, review them carefully. A backdoor hiding in uploads can outlive a plugin or theme cleanup, since uploads are usually left untouched during a site repair.

Also check other writable directories, such as:

• wp-content/uploads/
• wp-content/cache/
• wp-content/upgrade/
• Temporary directories
• Backup directories

Run another scan after removing anything suspicious. If the same files come back, another backdoor or a compromised account is still active somewhere.

Step 6: Check Hidden Admin and Account Backdoors

Not every backdoor lives in a file. Attackers frequently create, or quietly take over, an administrator account so they don’t need a file-based backdoor at all.

SiteFort’s account security findings, ghost administrator detection, password risk checks, and audit logs cover this ground. Look for:

• Hidden or unexpected administrator accounts
• Recently created admin users
• Suspicious email addresses
• Numeric or random usernames
• Unexpected role or capability changes
• Weak password risks
• Breached password risks
• Login activity that doesn’t match normal usage

Remove anything you don’t recognize, downgrade users who don’t need admin access, reset passwords for the legitimate administrators, and turn on two-factor authentication.

Step 7: Check Database and Content Backdoors

Some backdoors and reinfection triggers live in the database rather than in files. They show up as injected scripts, hidden links, suspicious URLs, malicious redirects, unsafe options, SEO spam, or code sitting in widgets and page builder fields.

SiteFort’s content and database safety findings point to indicators such as:

• Injected scripts
• Suspicious URLs
• Hidden links
• Spam keywords
• Redirect indicators
• Unsafe content indicators
• Suspicious options
• SEO spam symptoms

These can turn up in posts and pages, post meta, widgets, menus, page builder fields, custom HTML blocks, code snippet entries, or WordPress options. Move carefully through serialized data and page builder fields especially. A rushed edit there can break a layout or plugin settings just as easily as it removes the spam.

Step 8: Check Hosting, SFTP, and Control Panel Access

A WordPress-level cleanup won’t hold if the attacker still has access at the hosting layer.

Check access outside WordPress too:

• Hosting control panel users
• SFTP or FTP accounts
• SSH keys
• Database users
• DNS or Cloudflare access
• Email accounts used for password resets
• Old staging sites under the same hosting account

Reset credentials and remove anything you don’t recognize. If multiple sites share the same hosting account, scan and secure all of them. It’s not unusual for one infected site to be used to reinfect another one sitting right next to it.

Step 9: Patch the Entry Point

Removing a backdoor doesn’t help much if the original vulnerability that let the attacker in is still open.

Go through SiteFort’s vulnerability findings and update or remove the affected components. Common entry points include:

• Vulnerable plugins
• Vulnerable themes
• Outdated WordPress core
• Nulled plugins or themes
• Weak or reused passwords
• Compromised SFTP credentials
• Old staging sites
• Exposed backups
• Unsafe file permissions
• Unrestricted upload vulnerabilities

If a plugin is vulnerable and no patch exists yet, disable or remove it until one ships. If it’s abandoned, replace it with something actively maintained.

Step 10: Harden WordPress After Removing the Backdoor

Once the backdoor is gone and the entry point is patched, hardening is what makes the same attack harder to repeat. SiteFort can help apply and verify controls such as:

• Disabling the built-in theme and plugin file editor
• Blocking PHP execution in uploads, where supported
• Protecting sensitive files like wp-config.php, backups, logs, debug files, and Git directories
• Reducing user enumeration
• Restricting XML-RPC if you’re not using it
• Controlling application password behavior where appropriate
• Reducing WordPress version and metadata exposure
• Checking security headers
• Confirming that supported hardening rules are actually enforced

That last item matters more than it looks. A hardening setting is only worth something if it’s actually working on your specific hosting environment, not just switched on in a settings panel.

Step 11: Secure Login Access

Backdoor cleanup should always include a pass at login security, since a weak login is effectively a backdoor an attacker doesn’t even have to hide.

SiteFort’s login security features cover:

• Role-based two-factor authentication
• Authenticator app codes, email codes, or recovery codes
• CAPTCHA where appropriate
• Brute-force lockouts
• Safer login responses that reduce username guessing
• Weak password risk review
• Breached password risk checks
• Strong password enforcement by role
• Password expiration policies where appropriate
• A custom login URL, if that fits your workflow

Changing the admin password alone doesn’t help much if other access points are still wide open.

Step 12: Enable Firewall and Bot Protection

Attackers often keep probing a site well after a backdoor cleanup, so firewall and bot protection matter most in the days right after, not months down the line. SiteFort helps block:

• Bad bots
• Suspicious IPs or CIDR ranges
• Country-based traffic, where appropriate
• User-agent abuse
• Rate-limit abuse
• Repeated 404 probing
• Bots hunting for vulnerable plugins and exposed files
• Community threat intelligence
• Cloudflare Sync for supported rules where configured

Step 13: Verify the Backdoor Is Gone

Once you’ve worked through the steps above, verify from more than one angle. Check:

• A fresh SiteFort security scan
• File integrity findings
• Content and database safety findings
• Account and ghost administrator findings
• Vulnerability findings
• Hardening verification
• Audit log activity
• Firewall logs
• A fresh Securewp Remote Security Scanner result
• Logged-out browser behavior
• Mobile behavior
• Google Search result behavior, if SEO spam was involved

If the same malware turns up again, keep investigating. The remaining cause is likely another backdoor, a vulnerable plugin, a compromised account, an infected database entry, an exposed credential, or another infected site sharing the same hosting account.

Common Questions About WordPress Backdoors

Can a WordPress backdoor be removed manually?
Sometimes, if you know exactly where to look and have experience reading PHP for malicious code. In practice, backdoors are built to be hard to spot, and a missed one means the site gets reinfected. A scanner that checks file integrity, database content, and account activity together catches far more than a manual file-by-file review.

Does changing the admin password remove a backdoor?
No. A password reset stops one specific type of access, but a file-based backdoor, a hidden admin account, or a database-stored redirect will all survive a password change untouched.

How do hackers create a backdoor in WordPress?
Usually through a vulnerable plugin or theme, a compromised login, or an already-infected file that gets left behind after an earlier hack. Once they’re in, they plant a way back that doesn’t depend on repeating the original exploit. For a closer look at exactly what that planted code tends to look like, see our guide on common WordPress backdoor scripts.

Can a backdoor survive a full WordPress reinstall?
A clean core reinstall removes core-level backdoors, but it won’t touch anything hiding in uploads, plugins, themes, the database, or a compromised admin account. Reinstalling core alone is rarely enough on its own.

How long can a WordPress backdoor stay hidden?
Indefinitely, if nobody’s looking for it. Some backdoors sit dormant for months before an attacker reactivates them, which is why sites that were “cleaned” a while ago can suddenly show new symptoms with no warning.

When to Get Professional Help

Some backdoor infections are simple to resolve. Others are persistent, layered, and spread across files, database entries, user accounts, and hosting access all at once.

Get professional help if:

• Malware keeps returning after cleanup
• Unknown admin users keep appearing
• The site is redirecting visitors
• Google shows security warnings or SEO spam
• Your host suspended the site
• You can’t safely edit database entries
• The site handles payments, customers, memberships, or sensitive data
• You don’t have a clean backup

If you need hands-on help, our WordPress malware removal service can clean the infection, remove backdoors, repair damaged files, and help reduce reinfection risk.

Why Malware Returns After Cleanup

A WordPress backdoor is one of the main reasons malware returns after cleanup.

Removing the visible malware isn’t enough on its own. Check file integrity, suspicious files, plugins, themes, uploads, hidden administrator risks, database and content indicators, hosting access, vulnerabilities, login security, hardening, and firewall activity.

Use SiteFort to scan for backdoors, web shells, file changes, unsafe content indicators, ghost administrator risks, vulnerable components, exposed files, and weak hardening rules. Then verify the site again once cleanup is done.

If the infection comes back, the cleanup isn’t finished. Find the remaining access point before assuming the site is safe. For a deeper reference on the specific scripts and techniques attackers use to build that access, see unmasking common WordPress backdoor scripts.