A backdoor is code left behind so an attacker can return without needing the original vulnerability. Finding and removing them is the difference between a real cleanup and a temporary one.
WHAT THEY LOOK LIKE
A small PHP file with a random or innocuous name, often in an uploads or cache folder. Code appended to the end of a legitimate file, so the file still works normally. Heavily obfuscated content using base64 encoding, long hex strings, or functions assembled from fragments at runtime. A file with a recent modification date in a folder where nothing should have changed.
WHERE THEY HIDE
Uploads folders, cache and temporary folders, inactive themes and plugins, the root of the account above public_html, and inside legitimate core files.
FINDING THEM
Run ImunifyAV across the whole home directory, not just the website folder. Sort by Last Modified in File Manager and review recent changes. Compare core application files against fresh official copies.
REMOVING THEM
Delete the file, or restore the affected file from a clean copy. Then change all credentials, because the attacker may have collected them while they had access.
If a cleanup does not hold, assume a backdoor was missed and ask us to look. We can search the account from the server side.
