Security
Finding and removing a WordPress backdoor
29 April 2025 · 7 min read
A backdoor is a hidden access point that hackers leave in your WordPress website. Even if you have cleaned the original hack, a backdoor can give the hacker access again unnoticed. Finding and removing backdoors is one of the most difficult aspects of cleaning a hacked website.
At WP Maintainer we have more than 20 years of experience in cleaning hacked websites. We find backdoors that automated tools miss. In this article we share our expertise.
What is a backdoor?
A backdoor is sneaky code that gives an attacker access without having to log in normally. Backdoors can be disguised as innocent files or hidden in legitimate code. Typical forms: - Hidden admin users - Modified PHP files in upload folders - Encoded code in themes or plugins - Modified database entries - Hidden scripts in .htaccess or wp-config.php
Where backdoors hide
Hackers place backdoors in locations where they do not stand out: **In upload folders:** /wp-content/uploads/ — nobody expects PHP files here **In inactive themes:** Old themes that are not used but are present **In fake plugins:** Files that look like plugins but have no real functionality **In wp-config.php:** Hidden between legitimate configuration lines **In .htaccess:** Redirects or execution rights
How do you find a backdoor?
Manually finding backdoors requires technical expertise: 1. **Compare with clean files** — compare WordPress core, themes and plugins with the official versions 2. **Check file timestamps** — look for recently modified files you did not change 3. **Scan for suspicious code** — search for eval(), base64_decode(), exec(), system() and encoded strings 4. **Check users** — remove unknown admin, editor and author accounts 5. **Database inspection** — check wp_options, wp_users and wp_usermeta for suspicious entries
Automated tools
Tools that can help: - **Wordfence Security** — Thorough scan with comparison against original files - **Sucuri Scanner** — Detects suspicious code and malware - **MalCare** — Cloud-based deep scan - **WP-CLI** — Command-line scanning for advanced users
After removal
After removing backdoors the work is not finished: - Change ALL passwords (WordPress, hosting, FTP, database) - Update WordPress, all themes and plugins to the latest version - Remove unused themes and plugins - Install a firewall and monitoring - Make a clean backup of the cleaned website
Professional help
Finding backdoors requires experience and specialised knowledge. WP Maintainer offers professional cleanup service with guarantee. We find and remove ALL backdoors and ensure your website is 100% clean again. Contact us for immediate help.