An auto-prepend file is a PHP feature controlled by the auto_prepend_file setting. When enabled, PHP loads one specified file before it executes the requested script. The setting can be defined in php.ini, per-directory config such as .user.ini, or web server configuration.
This matters in cyber security because it gives an attacker an early execution point. A malicious prepend file can inject a backdoor, alter authentication, hide code, or restore other malware before the application starts. In WordPress incidents, that makes cleanup harder: deleting the visible payload may not help if a prepended file or config entry silently reloads it on every request.
Defenders should inspect PHP configuration, search for unexpected prepend paths, and compare active settings with known-good baselines. Removing the malicious file alone is not enough if the directive still points to it.