Backdoor scripts are one of the most common reasons a hacked WordPress website keeps getting reinfected after cleanup.

You may remove the visible malware, reset passwords, update plugins, and still see the attacker come back a few days later. In many cases, the reason is simple: a hidden backdoor was left behind.

A WordPress backdoor gives attackers a secret way to regain access without using the normal login screen. It can be hidden inside a theme file, fake plugin, modified core file, upload directory, database entry, cron job, or even a file that looks harmless at first glance.

This guide focuses on what backdoor scripts actually look like: how attackers hide them, the common types you’re likely to run into, and the code patterns worth recognizing on sight. If you already suspect an active backdoor and want the full step-by-step removal process, go straight to our guide on how to find and close a WordPress backdoor.

What Are WordPress Backdoor Scripts?

A backdoor script is malicious code that allows an attacker to bypass normal authentication and maintain access to a website after it has been compromised.

Unlike obvious malware that redirects visitors or displays spam, a backdoor is usually designed to stay quiet. Its main purpose is persistence. The attacker may use it later to create a new admin account, upload more malware, inject spam links, redirect visitors, modify files, or take control of the site again.

This is why a hacked WordPress site should never be cleaned by removing visible symptoms alone. If the backdoor remains, the same site can be reinfected even after passwords are changed.

Why WordPress Backdoors Are So Dangerous

  • They are built to hide. Backdoors often blend into legitimate WordPress files, plugins, themes, or upload folders.
  • They allow repeated access. Attackers can return even after the original vulnerability is patched.
  • They can create hidden admin users. Some backdoors silently create administrator accounts or hide those users from the WordPress dashboard.
  • They can upload more malware. A small backdoor can be used to install larger malware, phishing pages, spam scripts, or web shells.
  • They are easy to miss during manual cleanup. A site may look clean on the front end while still containing malicious code in the background.

How Hackers Hide Backdoor Scripts in WordPress

Backdoors can be hidden in many places. The most common locations are theme files, plugin files, upload directories, WordPress core files, and the database.

1. Obfuscated PHP Code

Attackers often hide malicious instructions using obfuscation. The code may look like random text, encoded strings, or a long unreadable block of PHP.

Common suspicious patterns include:


eval(...)
base64_decode(...)
gzinflate(...)
str_rot13(...)
shell_exec(...)
system(...)
passthru(...)
assert(...)
preg_replace(... /e ...)

These functions are not always malicious by themselves, but they deserve attention when found in unexpected files, especially inside uploads, theme templates, fake plugins, or recently modified files.

2. Fake Plugin or Theme Files

Attackers commonly create fake plugin folders with names that look normal, such as cache helpers, security tools, backup utilities, or system maintenance plugins.

Examples of suspicious patterns:

  • A plugin folder you do not recognize
  • A plugin that does not appear in the WordPress admin plugin list
  • Files with names similar to legitimate WordPress files but slightly changed
  • PHP files placed inside image or cache folders

This technique works because many WordPress sites have several plugins installed, and fake plugin files can easily be overlooked during a quick review.

3. Modified Theme Files

Theme files such as functions.php, header.php, footer.php, and index.php are common targets.

A backdoor in functions.php can run automatically when WordPress loads. This makes it a popular place for hidden admin account creation, spam injection, redirect logic, and remote command execution.

4. WordPress Core File Changes

Attackers sometimes inject code into core files because site owners rarely inspect them manually.

Commonly targeted files include:

  • wp-config.php
  • index.php
  • wp-load.php
  • wp-settings.php
  • Files inside wp-includes
  • Files inside wp-admin

In a clean WordPress installation, core files should match the official WordPress release. Unexpected changes to core files should always be investigated.

5. Upload Directory Backdoors

The wp-content/uploads directory should normally contain images, documents, and media files, not executable PHP scripts.

If you find PHP files inside upload folders, especially with random names or old timestamps, treat them as suspicious until verified.

Attackers often place web shells here because upload directories are writable and may not be checked as carefully as plugin or theme folders.

6. Database Backdoors

Not every backdoor lives in the file system. Some are hidden inside the WordPress database.

Common locations include:

  • wp_options
  • Widget content
  • Post content
  • Theme/plugin settings
  • Custom tables created by plugins

Database-injected malware may contain encoded scripts, spam links, redirect rules, or hidden admin-related options.

7. Cron Jobs and Scheduled Tasks

Some attackers use WordPress cron jobs or server cron jobs to reinfect the site after cleanup.

For example, a malicious scheduled task may check whether a backdoor file still exists. If the file was removed, the cron job can recreate it automatically.

This is one reason reinfection can happen even after the obvious malware files are deleted.

Common Types of WordPress Backdoors

1. Hidden Admin Access Backdoor

This type of backdoor allows an attacker to log in as an administrator without using a valid username and password.

It may use normal WordPress functions, which makes it look less suspicious during a quick review. The dangerous part is not always the function itself, but how it is being used.

Why it matters:

  • It can bypass the normal login process.
  • It can allow full administrator access.
  • It may continue working even after passwords are reset.
  • It can be hidden inside theme files, fake plugins, or random PHP files.

2. Admin Account Creator Backdoor

This is one of the most common backdoors found in hacked WordPress sites.

The attacker adds code that creates a new administrator account when a specific URL parameter is visited. In more advanced cases, the malicious user is hidden from the WordPress user list, and the dashboard administrator count is manipulated to avoid detection.

Common signs:

  • Unknown admin users
  • Usernames like support, wpservice, wpsupport, system, update, or adminbackup
  • Admin accounts that do not appear normally in the dashboard
  • Recently created users with no clear reason

3. File Upload Backdoor

A file upload backdoor allows attackers to upload new files to the server. Once installed, it can be used to add more malware, phishing pages, spam scripts, or additional web shells.

These scripts are often very small and may not look dangerous at first glance.

Common signs:

  • Unknown PHP files in upload folders
  • Unexpected files created around the time of the hack
  • POST requests to unusual PHP files
  • Files with random names or misleading extensions

4. Web Shell Backdoor

A web shell gives attackers a way to run commands or manage files through a browser-based interface.

Some web shells are large and obvious. Others are only a few lines long and heavily obfuscated.

Common signs:

  • Suspicious command execution functions
  • Unknown file manager-like scripts
  • PHP files in writable directories
  • Unusual outbound connections from the server

5. Redirect and SEO Spam Backdoors

Some backdoors are designed to inject spam links, redirect visitors, or modify search engine behavior.

These attacks may only trigger for certain visitors, such as users coming from Google, mobile devices, or specific countries. That makes them harder to reproduce during normal testing.

Common signs:

  • Visitors redirected to spam or scam websites
  • Search results showing Japanese, pharma, casino, or adult spam
  • Clean homepage for logged-in admins but infected output for normal visitors
  • Suspicious scripts in posts, options, widgets, or theme files

How to Recognize Backdoor Code

Spotting a backdoor usually comes down to two things: knowing which functions attackers lean on, and knowing where to look for files that don’t belong.

Search the file system for suspicious functions and encoded code patterns. These aren’t malicious on their own, since legitimate plugins use plenty of them too, but they’re worth a second look in files that shouldn’t have any business calling them, like a random PHP file sitting in uploads:


eval(
base64_decode(
gzinflate(
shell_exec(
passthru(
system(
proc_open(
curl_exec(
file_put_contents(
move_uploaded_file(

Context is what separates a false alarm from a real finding. A backup plugin using file functions normally is expected. That same function sitting inside an unrecognized file in wp-content/uploads is a serious warning sign.

Beyond scanning for these patterns, a full investigation usually covers recently modified files, a comparison against clean WordPress core files, a review of theme and plugin code, server access logs, WordPress user accounts, and the database itself. We walk through each of those in detail, including exactly where to check and what SiteFort surfaces at each step, in the backdoor removal guide.

A malware scanner speeds up all of this considerably. Beyond Securewp’s remote scanner for a quick outside check, SiteFort scans from inside WordPress itself, checking for known backdoor patterns, suspicious file changes, vulnerable plugins, injected JavaScript, SEO spam, and exposed sensitive files, with a hash-first approach designed to stay lightweight even on shared hosting.

What to Do If You Find a Backdoor

Finding one backdoor file and deleting it isn’t the finish line. A backdoor is usually just one part of a larger compromise, and a full cleanup needs to cover the files, the database, user accounts, credentials, and the original entry point together, not just the file you happened to spot first.

Our step-by-step backdoor removal guide walks through the full process: scanning, repairing file integrity, checking uploads and plugins, cleaning database injections, auditing accounts and hosting access, patching the entry point, hardening, and verifying the fix actually holds. If you’ve found something suspicious and need to act now, that’s the guide to follow.

If the site is business-critical or keeps getting reinfected, a professional WordPress malware removal service is usually the faster path. Reinfection almost always means the root cause wasn’t fully removed the first time.

How to Prevent WordPress Backdoors

1. Keep WordPress, Plugins, and Themes Updated

Outdated plugins and themes are one of the most common entry points for WordPress attacks.

Update WordPress core, plugins, and themes regularly. Remove anything that is abandoned, unused, or no longer receiving security updates.

2. Avoid Nulled Themes and Plugins

Nulled themes and plugins are a major risk. They often contain hidden malware, backdoors, spam injectors, or license-bypass code that gives attackers access to your site.

Only install themes and plugins from trusted sources, such as WordPress.org, official vendor websites, and reputable marketplaces.

Read more: Nulled Themes and Plugins: Your Website’s Security at Risk.

3. Use Two-Factor Authentication

Strong passwords help, but passwords can still be leaked, reused, or stolen through phishing.

Enable two-factor authentication for administrator accounts. This reduces the risk of attackers logging in even if they obtain a valid password.

4. Harden WordPress

WordPress hardening reduces the number of easy attack paths available to bots and attackers, including disabling dashboard file editing, blocking PHP execution in upload directories, protecting sensitive files, limiting user enumeration, and controlling XML-RPC access.

The hardening step in our removal guide covers the full list of controls and why the verification step matters more than just switching a setting on.

5. Use a Firewall

A firewall blocks malicious requests before they reach vulnerable parts of your site, including brute-force attempts, bad bot traffic, common exploit attempts, and automated vulnerability probing.

6. Monitor Vulnerabilities

Backdoors often appear after attackers exploit a vulnerable plugin or theme, which is why vulnerability monitoring matters even on a site that looks clean.

Monitor installed plugins, themes, and WordPress core for known vulnerabilities. Patch quickly when a security update is available. If a plugin is abandoned or no fix exists, replace it.

7. Review Activity Logs

Audit logs help you understand what changed and when: admin logins, failed login attempts, plugin installations, theme edits, user or role changes, and firewall blocks. If a suspicious admin account appears or a plugin gets installed without approval, logs are usually the fastest way to trace what happened.

8. Scan Regularly

One-time cleanup isn’t enough. Schedule regular malware scans covering backdoors, web shells, malicious PHP, injected JavaScript, SEO spam, suspicious redirects, modified core files, vulnerable plugins and themes, and exposed sensitive files.

SiteFort brings scanning, hardening, firewall, login security, 2FA, vulnerability alerts, and audit logs into one dashboard, with monthly free scan credits for regular checks and scheduled scanning on Pro.

Final Thoughts

WordPress backdoors are dangerous because they are quiet, persistent, and often difficult to spot during a basic cleanup.

If your site was hacked, don’t stop after removing the visible malware. Watch for hidden admin users, suspicious PHP files, modified core files, fake plugins, upload directory scripts, database injections, cron jobs, and signs of reinfection.

The best defense is layered: keep everything updated, avoid nulled software, use strong login protection, harden WordPress, enable a firewall, monitor vulnerabilities, review activity logs, and scan regularly.

If you suspect an active backdoor right now, go to our full backdoor removal guide for the step-by-step process. For prevention going forward, SiteFort brings malware scanning, firewall protection, login security, 2FA, vulnerability alerts, hardening, and audit logs into one WordPress security dashboard.

For deeper cleanup or repeated reinfections, our WordPress malware removal service can help directly.

You may also find these guides helpful: