How to Find and Remove PHP Webshells and Backdoors on Your Server

A webshell or backdoor is a malicious file an attacker leaves behind to regain access to your site whenever they like — which is why sites get "reinfected" days after a cleanup. Finding and removing every backdoor is the step that makes a cleanup actually stick. This guide is about detection and safe removal, not attacker techniques.

Where backdoors hide

• In upload and cache folders that should never contain executable code.
• Disguised with innocent names like wp-config-backup.php or names mimicking real files.
• Injected into legitimate files, so a real file also contains malicious code.
• In rarely-checked directories deep in the site.

Step 1: Scan the whole account

Start with a thorough scan — see scanning with Imunify360 and, for WordPress, Wordfence. Good scanners recognise common backdoor patterns.

Step 2: Look for recently modified files

Attackers' files usually have recent modification dates. Over SSH you can list recently changed files to spot anything modified around the time of the compromise that you did not change yourself.

Step 3: Remove carefully

For standalone malicious files, delete them. For backdoors injected into legitimate files, the safest fix is to replace that file with a clean official copy rather than trying to snip out the bad code and risk missing some. Take a backup before deleting, in case you need to check something.

Step 4: Change all credentials

Assume the attacker had access. Change your cPanel, database, FTP and application passwords after removing backdoors, so any stolen credentials are useless.

Step 5: Verify and monitor

Re-scan to confirm nothing remains, watch your logs for renewed access attempts, and complete the hardening checklist.

Frequently asked questions

Why does my site keep getting reinfected?

Almost always because a backdoor was missed. Even one surviving backdoor lets the attacker return and re-plant malware. Thorough backdoor removal is the fix.

Can a scanner find every backdoor?

Scanners catch most known patterns, but a well-hidden or custom backdoor can slip through. Combine scanning with a manual review of recently modified files, and replace core files with clean copies to be safe.

Should I just rebuild from a clean backup?

If you have a known-clean, pre-infection backup, rebuilding from it and then patching the entry point is often the most reliable way to guarantee no backdoor survives.