What Is a Web Shell and How Do Attackers Use It?

A web shell is a script, usually PHP, that an attacker uploads to a website to run commands on the server through a browser. It is the most common first step after a site is compromised.

How they get in

• Vulnerable plugin or theme upload forms
• Stolen FTP or cPanel passwords
• Other infected sites on the same account

What they do

Attackers use web shells to send spam, host phishing pages, inject SEO spam into other files, steal databases and plant more backdoors so they can come back.

Signs of infection

• Unknown PHP files in uploads or cache folders
• .htaccess files appearing in every folder
• Sudden outgoing spam or high CPU

How to stop them

Scan files as they are written, block execution of PHP in upload folders, keep plugins updated and use a WAF that blocks upload attacks. xPGuard does all of this automatically and removes injected code without breaking the site.