A PHP web shell gives an attacker server-side capabilities such as browsing files, uploading payloads or executing commands within the permissions of the web process. It should be treated as evidence of a serious compromise, not a single-file infection.
Symptoms
- Unknown PHP files appear in uploads, cache or plugin directories.
- Files contain password-gated command handlers or file-manager interfaces.
- Attackers can recreate malware after ordinary cleanup.
- Access logs show direct requests to obscure PHP files.
Indicators of compromise
These indicators help investigation but should be interpreted in context. A single item does not automatically prove compromise.
How this threat persists
The web shell is a persistence/control mechanism. The attacker may have gained access through a vulnerable plugin, stolen credentials, another site under the same hosting account or a server-level compromise.
Investigation and recovery
- Preserve the suspicious file and access-log context before removal when incident evidence matters.
- Remove all related shells/backdoors and compare the filesystem with trusted sources.
- Review hosting account boundaries, credentials and neighboring sites if they share the same user/filesystem.
- Rotate exposed credentials and patch the original entry point.
- Monitor file creation and direct requests after recovery.
WP•FIX treats security incidents as root-cause investigations. The goal is not only to remove the visible payload, but also to identify the persistence mechanism and the access path that allowed the compromise.
Prevention after cleanup
Prevention depends on the actual entry point. Common controls include verified software sources, prompt patching of vulnerable components, credential rotation after compromise, least-privilege administrator access, clean backups, file-change monitoring and review of hosting/CDN/security logs.
FAQ
Can I just delete the web shell?
Deleting it removes one control point, but another shell or the original vulnerability may remain.
Why are web shells hidden in uploads?
Uploads directories are large and frequently writable, so malicious files can be easier to hide there.
Does a web shell mean the whole server is compromised?
Not always, but it warrants checking the permissions and account scope the attacker could access.
Should I preserve a copy?
For business incidents, preserving evidence can help reconstruct the attack. Store it securely and do not execute it.
Seeing signs of PHP Web Shell?
Send the site URL and the exact behavior you or visitors see. Include screenshots or warning text when available.
Open a security incident