What Is a Backdoor?

Definition

A backdoor is a hidden way into a system that bypasses the normal login. NIST's glossary defines it as "an undocumented way of gaining access to a computer system" and notes that it is a potential security risk. Attackers plant backdoors so they can come back even after a password is changed or the visible damage is cleaned up.

How It Works

Backdoors come in several forms:

• Planted after a break-in. The most common kind on websites: a small PHP file in an uploads or plugin folder, code appended to a theme's functions.php, a malicious scheduled (cron) job, or a hidden administrator account.
• Network listeners. NIST's glossary also describes a backdoor as a malicious program that listens for commands on a TCP or UDP port.
• Built into software. Malicious code inserted upstream, in a library or update, so every install carries it (see the example below).

On hacked WordPress sites, the backdoor is the reason infections "keep coming back." Sucuri's 2023 Hacked Website and Malware Threat Report, based on sites its team cleaned, found at least one website backdoor on 49.21% of compromised websites. It also found that 55% of sites with database malware had at least one malicious admin user, letting attackers regain control after cleanup. Sucuri notes its data reflects the environments it inspected, not the entire web.

Real-World Example

On March 29, 2024, CISA issued an alert about malicious code embedded in XZ Utils versions 5.6.0 and 5.6.1, a data compression library that may be present in Linux distributions. The issue was assigned CVE-2024-3094. NIST's National Vulnerability Database describes how, through "a series of complex obfuscations," the build process extracted a prebuilt object from a disguised test file and used it to modify the liblzma library, which other software links against. CISA warned that the code may allow unauthorized access to affected systems and recommended downgrading to an uncompromised version, such as 5.4.6, and hunting for malicious activity. The NVD record scores it 10.0, Critical.

Why It Matters for a Small Business

A backdoor turns one incident into a subscription. If cleanup removes the visible spam or ransom note but misses the backdoor, the attacker walks back in, often within days, and the business pays for the same cleanup twice. Sucuri's finding that roughly half of the compromised sites it remediated had a backdoor is why a real cleanup has to look past the obvious symptoms. The same report found malicious cron jobs, which usually re-dropped backdoors, on 2.14% of compromised sites, and fake plugins on 4.18%, both built to survive a surface-level cleanup.

How to Spot It / How DTS Handles It

Signs: PHP files in wp-content/uploads/; code using eval, base64_decode, or gzinflate where it does not belong; admin users nobody created; unfamiliar cron jobs; files changed outside update windows; and reinfection after cleanup.

DTS takes a forensic backup first, runs wp core verify-checksums and wp plugin verify-checksums, and audits users, recently changed PHP, mu-plugins, cron events, .htaccess, and injected options or posts. With the owner's approval we remove every foothold, rotate all passwords, keys, and salts, review two-factor login, and close the original entry point. See our hacked WordPress cleanup service, or read why spam links keep coming back.

Related Terms

• Webshell: a common type of backdoor on web servers.
• Rogue admin user: a backdoor that looks like a normal account.
• Supply chain attack: how XZ Utils carried a backdoor into downstream software.
• Eradication: the response step that has to find every backdoor.
• File integrity monitoring: detects the file changes backdoors make.
• Malware: the broader category backdoors belong to.

Sources

• NIST CSRC Glossary, backdoor: https://csrc.nist.gov/glossary/term/backdoor
• CISA, Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3094 (March 29, 2024): https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094
• NIST National Vulnerability Database, CVE-2024-3094: https://nvd.nist.gov/vuln/detail/CVE-2024-3094
• Sucuri, 2023 Hacked Website & Malware Threat Report (vendor research): https://sucuri.net/reports/2023-hacked-website-report/

---

Last updated October 14, 2026.