PHP malware in the uploads folder: how to find it quickly
The uploads folder should hold images and documents. A PHP file in there is nearly always a backdoor.
It's the easiest folder to write to, and attacks come in that way.
A vulnerable plugin, an upload form or a nulled theme can let someone drop files into uploads. From there a PHP backdoor takes the site back even after a clean-up.
The file often has a harmless name or a double extension, like cache.php or logo.php.jpg.
A scan that knows where to look.
First scan
The agent records the state of the site's files, skipping caches and folders that change all the time.
Later scans
Every hour it looks for new or changed files, in short steps.
Report
A PHP file in uploads or a suspicious double extension triggers a critical alert, and you can read the file from the dashboard.
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
Why is a PHP file in uploads so suspicious?
Because WordPress and Joomla never put executable code there. That folder should only hold media and documents.
Does scanning slow the site down?
No. It runs in steps of a few seconds and skips caches and other plugins' backups.
Goes well with
- WordPress core file integrity checksEvery file compared with the official checksums, with the changed lines.
- Instant alerts when a new administrator appearsNew admins, role changes and logins from unknown IPs, as they happen.
- SEO spam in the sitemap: the sign a site has been hackedBloated sitemaps, spam URLs and robots.txt files that block Google.
- Joomla core file integrity checks, even without official checksumsChecksums computed from the official Full Package, for Joomla 3, 4, 5 and 6.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.