The WordPress backdoors that survive a cleanup
You cleaned the files, reinstalled core and changed passwords, and a week later the malware is back. Often the code was in the database, or somewhere WordPress runs on every page.
Malware knows where WordPress shows nothing.
A cron event that runs a file in a hidden folder, an option with a hex name holding packed PHP, a must-use plugin that can't be deactivated: none of these show on the usual screens.
Then there are hidden administrators: a filter in the code removes the account from the Users screen, but the account exists and works.
What the agent checks.
Cron events
Events whose code sits in a hidden folder, that were created at runtime, or that point to a file flagged as malware.
Database and mu-plugins
Options with generated names and packed PHP, hidden must-use plugins and drop-ins WordPress doesn't know.
Accounts and plugins
Administrators the Users screen doesn't show, and plugins whose files differ from the checksums WordPress.org publishes.
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
Do you remove the malware?
No. We tell you what we found and where. The agency does the cleanup, with the backup at hand.
Do you run the suspicious code to analyse it?
No. The agent reads files and the database; it never runs the code it finds.
Goes well with
- PHP malware in the uploads folder: how to find it quicklyPHP in uploads, including names like .php.jpg, and suspicious files.
- Instant alerts when a new administrator appearsNew admins, role changes and logins from unknown IPs, as they happen.
- WordPress core file integrity checksEvery file compared with the official checksums, with the changed lines.
- 169 automatic configuration checks for WordPress, Joomla, Drupal and PrestaShopHidden admins, risky settings, exposed databases and files, with what to do.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.