A PHP backdoor is a malicious script written in PHP that an attacker plants on a web server to keep unauthorized access after the initial intrusion. Because PHP runs on many websites and web applications, a backdoor can blend into normal site files while quietly accepting commands, creating new admin users, stealing data, or launching further attacks.
Backdoors matter because they provide persistence. Even if the original vulnerability is patched, the attacker may still return through the hidden script. In real incidents, backdoors are often uploaded through file upload flaws, stolen credentials, vulnerable plugins, or compromised admin panels. Defenders look for suspicious PHP files in web directories, unexpected changes to timestamps or permissions, strange outbound network activity, and requests to unusual filenames. Blocking PHP execution in upload folders, restricting write access, and scanning for webshell-like behavior help reduce the chance that a simple upload becomes a lasting compromise.