Website keeps getting hacked: how to find the backdoor

If you have already cleaned the site and a day or a week later it is infected again, the cause is almost always the same: you removed the symptom but did not close the way in. A backdoor was left behind, a hidden script through which the infection returns automatically. While it lives, cleaning is pointless: the code is re-uploaded through the same route. Below: what a backdoor is, where it hides, how to find it, and how to close the way in so the site stops getting hacked.

Why the site keeps getting hacked

A repeat hack is not bad luck, it is a pattern. The cause is always that the previous cleanup was incomplete:

• The visible infection (a redirect, spam pages) was removed, but not the mechanism that creates it.
• A backdoor was left behind: a file or a snippet of code that gives the attacker access bypassing the password.
• The vulnerability used to get in the first time was never closed, so they can get in again.

Removing the infection and closing the way in are two different jobs. Without the second, the site is hacked again the same way, often the same day.

Check your site right now

The tool opens your site from the outside the way a search engine and a mobile visitor see it. An active infection, a redirect and cloaking show up at once, along with an outdated CMS version, which is usually the way in. No access to the site is required.

What a backdoor is and where it hides

A backdoor is a hidden entry point left behind after a hack. It is hard to find because it disguises itself. The typical places:

• A web shell: a separate .php file with a random name in the uploads, media or cache folder.
• An insert in a legitimate file: a single line in index.php, functions.php or a template file, often via eval(base64_decode(...)).
• A fake image file: a .php disguised as an image or an icon.
• In the database: code in template parameters or records that runs when the page loads.
• A cron job: restores deleted files on a schedule.
• A rogue administrator in the CMS or a new owner in Search Console.

How to find the backdoor

The order that actually finds the hidden entry:

1. Compare the files with a known-clean copy of the CMS: anything extra is suspect.
2. Sort files by modification date: infected ones usually changed at the same time.
3. Search the code for suspicious functions: eval, base64_decode, gzinflate, assert, preg_replace with the e modifier.
4. Check folders where no .php should be: uploads, images, media.
5. Check cron jobs and the list of CMS administrators.
6. In the database, check template parameters and service records for foreign code.

Why the hosting antivirus does not find it

A very common trap: the host says "all clean" while the site keeps getting hacked. There are two reasons. First, the antivirus looks for files by known signatures, while the backdoor is either obfuscated (encrypted) or looks like legitimate code. Second, part of the mechanism sits in the database or in a cron job, not in the files. The files really are clean, and the scanner honestly reports that.

How to close the way in for good

To stop the site being hacked, removing the backdoor is not enough. You have to close the door itself:

• Find the entry point in the server logs: which extension or vulnerability let them in.
• Update the CMS and all extensions to supported versions, remove unused ones.
• Change every password and key: admin, FTP and SSH, database, hosting panel, CMS secret keys.
• Confirm no other backdoors or cron jobs remain.
• Restrict access to the admin area, enable basic protection and set up clean backups.

If the site is on Joomla or WordPress

Joomla. Joomla 3 is especially exposed: no security updates since 17 August 2023. Attackers get in through extensions (JCE, SP Page Builder) or the Helix3 framework, and hide the backdoor in the media folder or in template parameters in the database. Without moving to version 5 or 6 the site gets reinfected.

WordPress. Check the wp-content folder (the mu-plugins directory, the uploads folder for .php), the wp-config.php file, the active theme functions.php and the wp_options table. The way in is usually a neglected or vulnerable plugin.

When to call a specialist

It is worth calling in a specialist if:

• you have already cleaned the site two or more times and the infection returns;
• the backdoor cannot be found while the site keeps getting hacked;
• the code is obfuscated or sits in the database, and the hosting antivirus stays silent;
• the host suspended the account for malware;
• there is no working clean backup.