Backdoor

A backdoor is a concealed method of gaining access to a system, application or device that skips the usual login or security checks. It may be planted by an attacker after a compromise, inserted into software by a malicious insider or supplier, or left behind by developers as a debugging shortcut.

Why it matters

A backdoor gives long-term access that survives password changes, so attackers value it for persistence. Hard-coded maintenance accounts in devices and forgotten debug endpoints in software have repeatedly been found and abused. For website owners, a hidden web shell dropped in a writable folder is a classic example that lets attackers return after the original hole is closed.

Example

After cleaning a hacked website, an administrator compares files with a clean copy, finds a small script in the uploads folder that runs commands sent to it, removes it, rotates all credentials and closes the hole that allowed the upload. Fixing only the visible damage would have left the way back in.

Common mistakes

• Cleaning the symptoms but not looking for persistence.
• Leaving default or hard-coded credentials in devices.
• Allowing script execution in upload directories.
• Not reviewing third-party code and plugins.

Related

• Malware
• Trojan
• Rootkit
• Security audit

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.