How to Audit a Malaysian Website for Hidden Backdoors

When a website is hacked, the visible defacement is just a distraction. The real threat lies in the hidden backdoors the attacker leaves behind to guarantee future access. A thorough technical audit is required.

1. Verify Core and Plugin Checksums

Using WP-CLI via SSH is the fastest way to detect modified files. It compares the cryptographic hashes of your server's files against the official repositories.

wp core verify-checksums
wp plugin verify-checksums --all

Any file flagged by these commands has been tampered with and must be inspected or replaced immediately.

2. Hunting for Rogue Admin Accounts

Attackers often create hidden administrator accounts. Sometimes these are hidden via database manipulation so they don't appear in the WordPress dashboard.

Query your database directly using WP-CLI to list all users with administrator privileges:

wp user list --role=administrator

If you see an unrecognized email or username, delete it immediately. Also, check the wp_usermeta table for users who have illicitly granted themselves the wp_capabilities of an admin.

3. Scanning for Web Shells

Web shells are standalone PHP scripts that provide hackers with a command-line interface to your server. Use grep to search for common web shell execution functions in unexpected directories (like /uploads/):

grep -rnw 'wp-content/uploads/' -e 'shell_exec' -e 'passthru' -e 'system'

---

Need Expert Help?

Don't guess if your site is clean. We provide forensic audits for businesses like Daralwahi. Get our RM5,000 Ownership & Access Review for a deep-dive security inspection, or subscribe to our RM450/month Care Plan to prevent backdoors altogether. Contact us today.