A backdoor is a hidden or undocumented way into a system outside its normal administration route.
Definition source: NIST: backdoor. Read on October 24, 2026. The practical questions on this page help you define the issue with your administrator.
What does a backdoor mean for your site?
NIST defines a backdoor as an undocumented way of gaining access to a computer system. For a website, the question concerns access you cannot explain through normal administration. A web shellA web shell is a script on a web server that lets an attacker keep remote access to that server. can provide such access.
The terms are not interchangeable: backdoor describes an access route, while web shell describes a particular technical form.
A backdoor can exist without changing the appearance of your homepage. Separate the visitor experience from access behind the scenes. A successful test order tells you something about the shopping journey, but it does not establish who can access administration.
Have these questions answered separately rather than treating a working page as a security finding.
Which observations deserve investigation?
Which PHP version does your site report?
We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.
An unexplained change that returns or an account nobody recognizes needs checking. Start by recording what you can observe. An unfamiliar account might belong to a previous supplier; that alone does not make it a backdoor.
Check the assignment, owner and access rights before making an accusation about a person or company.
A warning about suspicious code is an indicator of compromiseAn indicator of compromise is a technical observation that may point to an attack or unauthorized access to a system.. Ask what the check actually found. Have someone establish whether it provides usable access, is an inactive file or needs further investigation.
Leave the suspicious code alone until an authorized administrator has recorded the relevant state.
What should you do about possible access?
Ask your administrator to decide how to restrict unwanted access and which records need preserving. Changing your own password may be insufficient when a separate entry route exists. Ask which other accounts, keys and installations fall within the investigation.
Never submit those keys through an ordinary contact form or include them in a screenshot of a warning.
If the finding concerns a WordPress pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop., record where the installed package came from. A familiar product name on screen does not prove that its files came from the developer. Have the official version compared with your installation.
Do not experiment with suspicious files on a copy that can reach production information.
When should you ask for help?
Get help if you do not know who can investigate the access, or if a previous removal did not explain the problem. Provide the original warning, timeline and affected sites. Request separate answers about the access found and the cause established.
An investigation may have a clear answer to the first question while the second remains open.
Agree which findings will be recorded and what checks follow any changes. Record what was not examined as well. A statement about inspected website files is not a statement about every account in your organization.
If the cause remains unknown, assign someone to resolve that question and record the next step.
Product and company names on this page belong to their respective owners. We use them to describe the subject. We are not affiliated with those parties.
Prepare your request for help
Write a short note for your administrator naming the page, the time of the observation and what your team changed beforehand. Include the original warning if one is available. Keep facts separate from suspicions.
Describing what you saw on a particular page is more useful than stating a conclusion that has not been investigated.
For routine maintenance of a PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. site, review the existing PHP services. First discuss which question fits the service. This glossary page explains a term; it does not examine your installation or promise recovery.
For a possible incident, establish the expertise needed and which components someone can actually assess before agreeing the work.
Agree who receives the findings and who follows up an open question. Request a report identifying the areas checked, the date and the limitations. That helps you decide on a next step without treating general reassurance as evidence.
Your own first step is to record the observation and pass it to the administrator responsible for the site.
Frequently asked questions
Is an unfamiliar account always a backdoor?
No. Establish who owns the account and why it exists. Unexplained access deserves investigation but does not establish its cause.
What should I tell my administrator?
Provide the page, time and original warning. Describe what you observed and what remains a suspicion. Do not submit passwords, keys or customer personal information through an ordinary contact form.
Can the PHP Exposure Check establish this?
No. It reports public information such as the PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. exposed by your server. It does not investigate malware, access permissions or interception of form input.
Have your specific warning assessed separately.