WordPress Backdoors: What They Are and How to Find Them

By Hridoy Ahmed | Last updated: October 2026 | 8 min read

Short answer: A WordPress backdoor is hidden code or a hidden account that lets someone get back into your site, even after you removed the visible malware. To find one, check your admin users, recently changed files, the uploads folder, unknown plugins and your WordPress core files. If you find one, clean everything and fix the cause, or the hacker will return.

What is a WordPress backdoor?

Think of a house where a burglar copied your key. You change the broken window, but they can still walk in through the front door. A backdoor works the same way. It gives an attacker a secret way back into your site.

It can be a hidden file, a code snippet added to a real file, a plugin you never installed, or an extra admin user. This is why many hacked sites get infected again a few days after a “cleanup”.

Signs you may have a backdoor

Your site gets hacked again after you cleaned it
An admin user you did not create keeps coming back
You find files or plugins you do not recognise
Spam pages or redirects return after you delete them
Your host warns you about suspicious files

Not sure if your site is hacked at all? Start with my guide on how to know if your WordPress site is hacked.

Where to look: 7 safe checks

Admin users. Go to Users and filter by Administrator. Remove anyone you do not know.
Plugins and themes. Look for items you did not install, old inactive ones and pirated (“nulled”) plugins or themes. Delete what you do not use.
The uploads folder. This folder is for images and documents. PHP files inside it are a red flag.
Recently changed files. In your hosting file manager, sort files by modified date. Look for changes you did not make.
WordPress core files. Compare them with a clean copy. If you use WP-CLI, the command wp core verify-checksums does this. Or simply reinstall core from WordPress.org.
Scheduled tasks. Unknown scheduled tasks (cron events) can re-create deleted malware.
The database. Check the users table for unknown admins and look for unusual entries.

A security scan helps, but it can miss things. Treat it as one check, not the final word.

What to do if you find one

Take a full backup first, even of the infected site, so you can go back if a cleanup breaks something.
Replace WordPress core files with a fresh copy.
Reinstall plugins and themes from the official source and delete anything you do not use.
Delete unknown files and users.
Change every password: WordPress admins, hosting, FTP, database. Also refresh the security keys in wp-config.php.
Update everything and close the hole that let them in. This is the step people skip.
Check Google Search Console for security issues, and monitor the site for a few weeks.

If you do not feel safe doing this yourself, see my WordPress malware removal service.

How to stop it coming back

Keep WordPress, plugins and themes updated
Never use nulled themes or plugins
Use strong, unique passwords and two-factor login
Give each user only the access they need
Use a firewall and keep off-site backups

My WordPress security checklist covers these steps in order, and you can use my free WordPress Security Checklist tool to track them.

Common mistakes

Removing only the visible malware and leaving the backdoor
Skipping password changes
Restoring an old backup that was already infected
Not finding out how the attacker got in

FAQ

Can a security plugin find every backdoor?

No. Scanners find many known problems, but they can miss new or well-hidden code. Manual checks help.

Will restoring a backup remove a backdoor?

Only if the backup was made before the infection. Otherwise you restore the backdoor too. Update everything right after restoring.

Why does my site keep getting hacked again?

Usually a backdoor or the original weakness is still there. Both must be fixed.

Can I clean a backdoor myself?

You can if you are comfortable with files and the database, and you take a backup first. If not, ask an expert.

Site hacked and not sure it is clean? See my WordPress security and malware removal service.

About the author: Hridoy Ahmed is an SEO specialist and WordPress security expert based in Dhaka, Bangladesh. He has 8+ years of experience and works with clients worldwide.