In WordPress, a drop-in is a special PHP file placed in the site root, such as db.php or advanced-cache.php, that loads very early in the request path. Because it runs before normal plugins and sometimes before much of the application stack, it can change core behavior, replace database handling, or intercept caching and bootstrap logic.
Drop-ins matter in cyber security because early execution makes them useful for both defenders and attackers. A legitimate drop-in can improve performance or customize platform behavior, but a malicious one can hide persistence outside the usual plugin list and survive simple cleanup. In real incidents, responders check drop-ins against known-good baselines, verify file hashes, and review whether their logic injects code, redirects requests, or contacts command-and-control infrastructure. If a site keeps reinfecting itself, an overlooked drop-in is a common place to look.