A web shell is a script on a web serverA web server is the program, such as Apache, Nginx or LiteSpeed, that answers when a visitor opens your site and sends back the page and files. that lets an attacker keep remote access to that server.
Definition source: MITRE ATT&CK: Web Shell. Read on October 24, 2026. The practical questions on this page help you define the issue with your administrator.
What does access through a web shell mean?
Your website may keep working while someone outside your team retains access. The term describes a tool on the server, not a screen that visitors must be able to see. MITRE describes a web shell as a script that gives an attacker access through a web server.
It can be a form of backdoorA backdoor is a hidden or undocumented way into a system outside its normal administration route..
A PHP web shell uses PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it., but web shells also exist for other server technologies. Having PHP does not prove an infection. Equally, removing PHP does not rule out unwanted access through other software or a hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. account.
Ask your administrator which access was found, where it works and which permissions it has.
What might you notice?
Which PHP version does your site report?
We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.
A file nobody on your team added, an unexplained change or a hosting warning deserves investigation. Such an observation is an indicator of compromiseAn indicator of compromise is a technical observation that may point to an attack or unauthorized access to a system., not a diagnosis based on a filename. Legitimate updates also add files.
Ask the administrator to compare the finding with official software and the changes approved for your site.
Request the location, time and reason for the warning. Keep the observation separate from the conclusion. A warning about another site in the same hosting account requires a different scope from a confirmed finding in your own installation.
Do not turn a general hosting notice into a claim about every site you operate.
What should you do first?
Do not open or run a suspicious script to find out what it does. Send the original warning to your administrator and ask which access needs restricting. Have relevant logs and a copy of the affected state preserved before changes begin.
An ordinary backupA backup is a separate copy of your website's files and database, so you can bring the site back after a mistake, a hack or a failed update. may already contain unwanted files, so restoring it does not establish that the entry point is closed.
Agree who investigates the origin, who makes changes and who checks the site afterward. Request a list of the areas examined. A report saying only that a file was removed leaves open whether the same access could be used again.
You do not need to reproduce an attack to ask that question.
When do you need specialist help?
Contact your host or a security specialist when access is confirmed, changes return or you cannot establish which sites share the affected account. Say whether customer information or payments are involved. Those details help determine the expertise needed.
Plan any PHP upgrade separately: changing a version does not replace an investigation into access that already exists.
Ask what remains outside the investigation. A review limited to website files says nothing about an administration account that was not examined. Keep those boundaries with the report so the next administrator does not treat a limited finding as a conclusion about the entire environment.
Product and company names on this page belong to their respective owners. We use them to describe the subject. We are not affiliated with those parties.
Prepare your request for help
Write a short note for your administrator naming the page, the time of the observation and what your team changed beforehand. Include the original warning if one is available. Keep facts separate from suspicions.
Describing what you saw on a particular page is more useful than stating a conclusion that has not been investigated.
For routine maintenance of a PHP site, review the existing PHP services. First discuss which question fits the service. This glossary page explains a term; it does not examine your installation or promise recovery.
For a possible incident, establish the expertise needed and which components someone can actually assess before agreeing the work.
Agree who receives the findings and who follows up an open question. Request a report identifying the areas checked, the date and the limitations. That helps you decide on a next step without treating general reassurance as evidence.
Your own first step is to record the observation and pass it to the administrator responsible for the site.
Frequently asked questions
Is every web shell written in PHP?
No. PHP is one possible server language. Establish which software and access are involved before choosing a recovery approach.
What should I tell my administrator?
Provide the page, time and original warning. Describe what you observed and what remains a suspicion. Do not submit passwords, keys or customer personal information through an ordinary contact form.
Can the PHP Exposure Check establish this?
No. It reports public information such as the PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. exposed by your server. It does not investigate malware, access permissions or interception of form input.
Have your specific warning assessed separately.