WordPress Backdoor Removal &
Persistent Webshell Cleanup

persistence
before eradication

You cleaned the malware, deleted the suspicious files, and reinstalled your plugins. Forty-eight hours later, the malicious scripts returned.

This recurring cycle happens because attackers rarely rely on a single file. Modern WordPress intrusions establish redundant persistence mechanisms: secondary PHP loaders hidden deep in media directories, obfuscated webshells disguised as core files, scheduled cron events inside wp_options, and rogue administrator accounts. We investigate and remove discovered persistence mechanisms through cryptographic checksum verification against clean WordPress repository binaries, database audit, and authentication invalidation.

← Back to Recovery Hub

Webshell Eradication Obfuscated PHP De-coding wp_cron Persistence Purging Rogue Admin Removal Security Salt Rotation

Dormant Secondary Loaders

Attackers place tiny, unobtrusive PHP scripts inside legitimate folders like /wp-includes/ or /wp-content/uploads/. Even if the primary redirect or spam script is deleted, the dormant loader can be pinged remotely to re-download the payload. Learn how stealth loaders sustain search engine poisoning in our Japanese keyword hack forensic analysis.

Automated Database Cron Persistence

Malicious routines are inserted directly into the cron option in the wp_options table. When WordPress processes automated tasks via wp-cron.php, it executes the malicious serialized hook, recreating files on disk automatically.

Stealth Administrator Accounts

Rogue users are inserted into wp_users with administrator capabilities hidden from standard dashboard views via pre_user_query filters in theme or plugin functions.

Tampered Core & Bootstrap Files

Injected code inside critical startup files—such as wp-config.php, index.php, or wp-settings.php—executes on every single HTTP request, ensuring persistent remote command execution.

Compromised Session Tokens

If security keys and authentication salts in wp-config.php are not regenerated, stolen cookies allow attackers to log into wp-admin without re-entering passwords, undoing cleanups within hours.

Backdoors vary widely in complexity, from single-line remote execution triggers to full-featured interactive file managers and terminal emulators.

1. Single-Line Eval & Assert Triggers

Minimalist backdoors such as @eval($_POST['cmd']); or assert($_REQUEST['pass']) embedded inside legitimate core files, allowing remote execution while blending into surrounding PHP code.

2. Obfuscated Multi-Stage Webshells

Heavily layered scripts utilizing base64_decode, gzinflate, str_rot13, and character arithmetic to construct execution handlers dynamically in memory, evading basic string pattern scanners.

3. Must-Use (mu-plugins) Injections

Standalone PHP loaders placed inside /wp-content/mu-plugins/. WordPress executes these files automatically on every boot cycle, even if the main active theme and plugins are completely deactivated.

4. Fake Plugin & Theme Clones

Rogue directories named after popular plugins (e.g., /wp-content/plugins/wp-seo-tool/) that appear legitimate to casual inspection but serve exclusively as persistent remote administrative panels.

STAGE 01

Core Binary Checksum Diffing

We compare every core WordPress file against official release checksums from WordPress.org. Any file with altered hashes is replaced with pristine binaries, instantly eradicating core-level backdoors.

Checksum

STAGE 02

Deep Filesystem Pattern Analysis

Execute targeted regex and AST-based searches across plugin, theme, and media directories for dangerous execution functions (eval, assert, passthru, system, preg_replace /e). Read our forensic guide to WordPress backdoors and stealth web shells for technical detection patterns.

Scanning

STAGE 03

Database Persistence & Cron Purging

Audit the wp_options table for suspicious autoloaded transients, rogue cron schedules in the cron array, and injected admin hooks. Purge all unauthorized database persistence entries.

Database

STAGE 04

User Privileges & Account Audit

Review all user accounts in wp_users and wp_usermeta to identify unauthorized administrator accounts or elevated capabilities, terminating rogue profiles immediately.

Accounts

STAGE 05

Session Invalidation & Salt Rotation

Regenerate all eight security keys and salts in wp-config.php to invalidate stolen session cookies. Update all administrator passwords and database connection credentials.

Hardening

Filesystem-Wide Webshell Discovery & Removal

Thorough inspection and eradication of identified obfuscated loaders, standalone webshell scripts, and disguised PHP files across all directories.

Core WordPress Re-installation from Source

Replacing all core files with verified pristine binaries directly from the official WordPress.org repository to eliminate tampered bootstrap files.

Database Cron & Transient Sanitization

Targeted SQL cleanup of corrupted cron arrays, malicious transients, and injected action hooks in wp_options.

Rogue Account Eradication & Privilege Reset

Complete removal of unauthorized administrative users and auditing of user capability arrays in the database.

Authentication Key & Salt Regeneration

Generating fresh cryptographic salts in wp-config.php to immediately terminate active sessions across all accounts.

To conduct deep forensic diffing and remove persistence mechanisms without causing downtime, we require access to the following components:

SFTP or SSH Access

Direct filesystem access is essential to run checksum tools, inspect file timestamps, and replace core binaries cleanly.

MySQL Database Access

Access via phpMyAdmin or database credentials to inspect wp_options cron entries and wp_users tables.

WordPress Administrator Access

An admin account to review active plugins, installed themes, and core site health before and after remediation.

Re-infection History & Logs

Any historical notes on when the site was previously cleaned, which files were deleted, and how quickly the symptoms returned.

We believe in rigorous technical transparency. Here are the realistic boundaries of backdoor remediation:

Identified vs. Future Vulnerabilities

We identify and remove discovered persistence mechanisms and remediate the entry points identified during the investigation. However, if third-party plugins remain outdated or if new zero-day vulnerabilities emerge in installed extensions, attackers may find new entry vectors. We pair remediation with hardening recommendations to mitigate this risk.

Root Server Compromises on VPS / Dedicated Hosts

If an attacker gained root SSH access to your operating system or installed kernel-level rootkits outside the web root, application-level WordPress cleanup must be paired with complete operating system rebuilds by your hosting provider. We verify whether the compromise is confined to the web root during diagnosis.

// 01 What is a WordPress backdoor and how does it work?

A WordPress backdoor is a piece of code deliberately left or planted by an attacker that allows them to bypass standard authentication and regain access to your server. Backdoors frequently accept remote commands via HTTP POST or GET requests, allowing the attacker to upload files, execute arbitrary PHP code, dump database contents, or recreate deleted malware payloads at will.

// 02 Why does malware keep returning after I delete infected files?

Intruders rarely deploy a single malicious file. Modern attacks establish multiple redundant persistence mechanisms: secondary PHP loaders hidden in wp-content/uploads/, scheduled cron jobs in the database that download new payloads at regular intervals, rogue administrator accounts, or backdoors appended to legitimate plugin files. If any persistence layer remains, the site reinfects itself automatically.

// 03 Where are WordPress webshells most commonly disguised?

Webshells are often disguised inside directories intended only for media, such as wp-content/uploads/2024/05/radio.php, or named to mimic legitimate core WordPress files, such as wp-includes/class-wp-cache.php or wp-content/plugins/akismet/akismet-cache.php. They may also reside in must-use plugins (wp-content/mu-plugins/) which execute automatically before regular plugins load.

// 04 Can security plugins guarantee that every backdoor is found and deleted?

Automated security scanners rely primarily on known signature databases. Sophisticated backdoors use custom variable names, dynamic string concatenation, and mathematical obfuscation to avoid matching known scanner signatures. Forensic identification requires cryptographic checksum comparisons against pristine WordPress.org binaries, database inspection, and manual code review of flagged anomalies.

// 05 Do you guarantee that no backdoors will ever compromise the site again?

We identify and remove discovered persistence mechanisms and entry points within the agreed scope. However, no security firm can guarantee perpetual immunity against future attacks, as software vulnerabilities in plugins or themes can emerge after cleanup. We pair backdoor removal with rigorous hardening to significantly reduce the risk of re-compromise.

// 06 Why is rotating WordPress salts essential during backdoor remediation?

WordPress security keys and salts in wp-config.php are used to cryptographically sign user session cookies. If an attacker stole administrative session tokens or password hashes, they can continue to access the wp-admin dashboard without entering credentials. Generating fresh salts immediately invalidates all active sessions across all users, severing unauthorized persistent access.

DISCOVER & ERADICATE

Is Malware Returning
to Your WordPress Site?

ENGINEERED RECOVERY

Stop the cycle of recurring infections. Send us your site details and reinfection history, and we will forensically isolate the persistence mechanisms.