You can remove all the visible malicious code and still be hacked. The reason is called a backdoor — a hidden snippet or a secret account that lets the attacker in again anytime. Finding them is what separates a real cleanup from a temporary fix that holds for a few days.
Hidden admin accounts
A common trick is to create another administrator — often with a believable name like ”support” or ”admin2”, or fully hidden so it doesn’t show in the user list. Check the number of administrators directly in the database (wp_users joined with wp_usermeta where wp_capabilities contains ”administrator”), not just in wp-admin, since the interface list can be tampered with. Also look for accounts with a registration date that doesn’t match your history.
Backdoors in files
- Obfuscated code like
eval(base64_decode(...)),gzinflateorstr_rot13. - PHP files in the uploads folder or other places where there should never be executable code.
- Core files with a changed timestamp or size compared to the original.
- Code that calls external URLs, runs system commands (
shell_exec,system) or loads remote content. - Files with innocent names (wp-cache-old.php, wp-conf.php) that don’t belong to a standard install.
Backdoors in the database and scheduled jobs
Backdoors don’t only live in files. An attacker can add a scheduled WP-Cron job that reinstalls malicious code, or inject code into an option that’s loaded on every page view. That’s why a scan must cover both the filesystem and the database — and ideally the WP-Cron list — to be complete.
Why it’s so hard to be sure
Backdoors are deliberately hidden in places you don’t think of, and a single missed one is enough for the whole cleanup to unravel. A common trap is to clean the visible part, believe you’re done, and get re-infected within a week — via a backdoor that sat there the whole time. That’s why professional cleanup starts from a file comparison against original core plus a full database scan, not manual searching file by file.
Get help before they come back
Our WordPress cleanup identifies and removes backdoors and unauthorized accounts, with a backup before every change and a report of what was found. And with Managed WordPress hosting we run the site in an isolated environment where one compromised component can’t reach the rest — plus monitored updates that close the entry points the backdoors came in through.