Hidden code left by an attacker so they can return to your site after a cleanup.
Last updated ยท Reviewed by Ali Hassan
Backdoors are small files or obfuscated code blocks that allow an attacker to upload new files or run commands. They are often named to look harmless, like wp-config-sample.php or theme-update.php. A cleanup that misses backdoors will be reinfected within days.
Related terms
Malware
Malicious code injected into your WordPress files or database, usually for spam, redirects, or data theft.
Hardening
A set of changes that make a WordPress site harder to attack: file permissions, login limits, security headers, and more.
File Integrity Monitoring
Automated checks that flag any change to core WordPress files outside of a planned update.
We have shipped hundreds of fixes for exactly this kind of issue. Book a 20 minute call and we will tell you straight whether it is a quick fix or a bigger root cause.