What Is a Webshell?

Definition

A webshell is a small script an attacker plants on a web server so they can control that server from a browser. On WordPress sites it is usually a PHP file. It works as a backdoor: the attacker can come back, run commands, and upload more malware even after you change every password.

How It Works

CISA's guidance on web shells describes the pattern:

1. Find a way to upload a file. Common routes are a vulnerable plugin or theme, a file upload form that does not check file types, SQL injection, cross-site scripting, file inclusion bugs, or an exposed admin panel with a stolen password. CISA names WordPress and other content management systems as a common target.
2. Drop the script. The webshell can be written in any language the server runs. PHP and ASP are the most common. It is often a few lines long, obfuscated, or given an innocent name.
3. Use the server's own permissions. Whatever the web server account can do, the webshell can do: add, delete, and run files, run shell commands, read wp-config.php and its database password, and connect to other internal systems.
4. Stay. Attackers use webshells to steal data and credentials, host more malware, send spam, and relay commands. MITRE ATT&CK classifies web shells as a persistence technique (T1505.003) for this reason.

Real-World Example

In May 2023 the CL0P ransomware gang exploited a SQL injection zero-day (CVE-2023-34362) in Progress Software's MOVEit Transfer, a file transfer web application. According to FBI and CISA advisory AA23-158A, internet-facing MOVEit servers were infected with a webshell called LEMURLOOT, first seen with the file name human2.aspx so it would blend in with the legitimate human.aspx. It only answered requests carrying a special HTTP header, X-siLock-Comment, set to a random 36-character password created at install. The attackers used it to pull data out of the underlying databases. MOVEit is .NET rather than PHP, but the pattern is the same one DTS looks for on WordPress: a lookalike file in a web folder that only its owner knows how to talk to.

Why It Matters for a Small Business

A webshell turns a one-time break-in into ongoing access. Cleaning visible spam or resetting passwords does not help if the shell stays in place: the attacker simply comes back through it. CISA also warns that antivirus products "sometimes produce poor results" detecting web shells, so a clean scan is not proof of a clean site. And because the shell runs with the web server's permissions, it can usually reach your database, which may hold customer accounts, orders, or form submissions that create notification duties if they leak.

How to Spot It / How DTS Handles It

CISA's warning signs include files newer than your last update, odd files in web folders, code containing eval, and image files receiving POST requests. On WordPress, a .php file in wp-content/uploads/ is a red flag.

DTS keeps the site up, backs up files and the database for forensics, then runs wp core verify-checksums and wp plugin verify-checksums, compares themes and premium plugins to clean copies, reads access logs to find the entry point, and checks admins, mu-plugins, recently changed PHP, options, posts, cron events, and .htaccess. With the owner's approval we remove every foothold at once, rotate salts and passwords, and review two-factor login. See our WordPress incident response package and the WordPress compromise checklist.

Related Terms

• Backdoor: the broader category a webshell belongs to.
• Indicators of compromise: file names, hashes, and request patterns that reveal a shell.
• File integrity monitoring: catches new or changed files early.
• Plugin vulnerability: a common route for uploading a shell to a WordPress site.
• Arbitrary file upload: the bug class that lets an attacker drop a script.
• Eradication: why deleting one shell is not the same as cleaning the site.

Sources

• CISA, Alert TA15-314A, Compromised Web Servers and Web Shells: Threat Awareness and Guidance (last revised August 9, 2017): https://www.cisa.gov/news-events/alerts/2015/11/10/compromised-web-servers-and-web-shells-threat-awareness-and-guidance
• MITRE ATT&CK, Server Software Component: Web Shell (T1505.003): https://attack.mitre.org/techniques/T1505/003/
• FBI and CISA, Cybersecurity Advisory AA23-158A, #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (June 7, 2023): https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a

---

Last updated October 14, 2026.