Glossary
Backdoor
A backdoor is code or configuration left on a system that lets an attacker regain access after the original entry point is closed.
Updated 2 Sept 2026
In detail
On web platforms a backdoor is typically a small file that accepts commands over HTTP — a web shell — but it can equally be an extra administrator account, a modified core file, a scheduled task, an SSH key, or a plugin that looks legitimate. Backdoors are what turn a one-off intrusion into persistent access, and they are the reason cleanups fail: removing injected spam without removing persistence means the spam returns, often within hours.
Why it matters
Persistence changes the shape of the incident. A site owner who deletes spam files and changes a password has not ended the compromise; the attacker still has a way in and can re-inject at will. CISA's incident guidance treats eradication of persistence as a distinct phase from removing the visible payload for exactly this reason.
Examples
- An obfuscated PHP file in wp-content/uploads/ that executes commands sent as a POST parameter.
- An unexpected administrator account created days before spam pages appeared.
- A modified theme functions file that re-downloads the payload from a remote host on every request.