PHP Website Security Checklist: 10 Steps to Protect Your Website from Web Shell Attacks

A web shell is a malicious script often written in PHP that gives an attacker remote control over your website server. Once installed, it can be used to steal customer data, alter pages, send spam, plant additional malware, or pivot to other systems. The good news: most web shell attacks exploit preventable weaknesses such as outdated plugins, weak passwords, insecure file uploads, and poor file permissions.

This practical checklist is designed for small businesses, WordPress owners, and website managers who want to reduce risk without turning security into a full-time job.

1. Keep PHP, WordPress, plugins, and themes updated

Outdated software is the most common entry point for website compromises. For WordPress sites, keeping WordPress core, plugins, and themes current is considered the single most important security measure.

Apply PHP security updates promptly through your hosting provider or server package manager.
Update WordPress core, plugins, and themes as soon as stable releases are available.
Remove plugins and themes you no longer use; inactive code can still contain exploitable vulnerabilities.
Prefer actively maintained plugins and themes over abandoned ones.
Test major updates on a staging site before deploying them to production.

A monthly maintenance schedule works well for many small businesses: review available updates, back up the site, apply changes, and verify that key pages and forms still function.

2. Use strong access controls and multi-factor authentication

Web shells frequently arrive after an attacker gains access to an administrator account. Protect every entry point: WordPress admin, hosting control panel, FTP/SFTP, database tools, and server SSH access.

Use unique, long passwords stored in a password manager.
Enable multi-factor authentication (MFA) for WordPress administrators, hosting accounts, and server logins.
Limit administrator accounts to people who genuinely need them.
Disable or rename default accounts where practical.
Review user accounts regularly and remove former employees, contractors, or unused accounts.
Restrict administrative access by IP address where your team’s locations allow it.

WordPress security guidance also recommends auditing failed login attempts and blocking abusive sources, which helps reduce automated password-guessing attacks.

3. Harden file and directory permissions

A web shell needs to be written to a location the web server can execute. Restricting write and execute permissions reduces the chance that a compromised plugin, upload form, or admin account can result in persistent server access. WordPress hardening guidance specifically advises avoiding unnecessary execute and write permissions.

Practical rules:

Web server users should not be able to write to core application files.
Upload folders should store files, not execute them.
Configuration files containing database credentials should be readable only by the necessary service accounts.
Avoid broad permissions such as 777; they are rarely necessary and often dangerous.
Separate deployment credentials from day-to-day editing access.

If you are unsure how permissions should be configured, ask your hosting provider or maintenance partner to document the approved baseline for your stack.

4. Secure file uploads

File upload features are a classic web shell delivery method. If a server is configured to execute uploaded code, an attacker may be able to upload a file that runs arbitrary commands.

Allow only the file types your business actually needs.
Validate file types on the server, not only in the browser.
Store uploads outside the web root where possible, or block script execution in upload directories.
Rename uploaded files and do not trust original filenames.
Scan uploads for malware before making them publicly accessible.
Prevent double extensions and unexpected executable types such as .php, .phtml, or .php5 in upload paths.

For a typical business website, this may mean allowing images and PDFs only—and routing all other document requests through a secure download process.

5. Deploy a web application firewall and malware scanning

A web application firewall (WAF) can block many common exploitation attempts before they reach your application. Malware scanners add another layer by looking for known malicious code, suspicious files, and unauthorized changes.

Enable a WAF at the DNS, CDN, or hosting level.
Run scheduled malware scans, not just on-demand scans after a suspected problem.
Scan both the web root and, where possible, databases for injected malicious content.
Configure alerts for newly detected malware, blacklist listings, or unexpected administrator creation.
Review scan reports rather than assuming a clean dashboard means no risk.

No scanner catches everything, especially obfuscated or newly created web shells. Use scanning as part of a broader monitoring program, not as your only defense.

6. Monitor file integrity continuously

File integrity monitoring compares current files against a known-good baseline and alerts you when files are added, changed, or deleted. This is one of the most effective ways to detect a web shell early, particularly when attackers use unfamiliar filenames or modify core files.

Your monitoring should cover:

New PHP files in the web root
Modified WordPress core, plugin, and theme files
Unexpected changes to .htaccess, web.config, cron jobs, or configuration files
Files with timestamps that do not match a known deployment
PHP files containing suspicious functions such as eval, base64_decode, system, shell_exec, passthru, or proc_open

For WordPress, compare core files against official checksums and investigate any plugin or theme file that differs from the vendor version.

7. Review logs for early warning signs

Logs often reveal an attack before the damage becomes obvious. Look for unusual POST requests, unexpected file writes, or the web server process launching shell commands—both are strong indicators of web shell activity.

Check regularly for:

Repeated POST requests to unusual PHP endpoints
Large or encoded request bodies
Requests from unfamiliar IP addresses or countries
New administrator accounts or password-reset activity
Web server processes spawning sh, bash, curl, wget, or similar tools
Sudden spikes in outbound email, which can indicate spam scripts

Even a simple weekly log review can catch problems that automated tools miss.

8. Maintain tested, isolated backups

Backups do not prevent an attack, but they determine how quickly you can recover. A backup stored on the same server as the website can be encrypted or deleted by an attacker, so keep at least one copy separately.

Back up files, databases, plugins, themes, and configuration.
Schedule daily database backups and regular full-site backups.
Store backups off-server or with a separate provider.
Encrypt backups and retain hashes or checksums so you can verify they have not been altered.
Test restores periodically; an untested backup is not a reliable recovery plan.
Keep several restore points, including a known-clean version before the most recent changes.

9. Limit damage with least privilege

Assume that any single component could be compromised. Least privilege limits what an attacker can do after getting in.

Give each website its own database user with only the permissions it needs.
Avoid using the server root account for routine website work.
Restrict database access to the application server where possible.
Disable PHP functions that your site does not require and that are commonly abused by web shells.
Use separate credentials for staging, production, backups, and third-party integrations.

This is especially important for businesses running multiple WordPress sites on one hosting account. A compromise on one site should not automatically expose every other site.

10. Prepare an incident response plan

When a web shell is found, speed and discipline matter. Do not simply delete a suspicious file and move on—the attacker may have created multiple backdoors, altered databases, or added rogue administrator accounts.

A practical response plan:

Isolate the site: take it offline, restrict access, or enable maintenance mode.
Preserve evidence: save logs, affected files, database exports, and screenshots before cleaning.
Identify the entry point: review logs, recently updated plugins, compromised credentials, and file changes.
Remove malicious files and unauthorized accounts.
Rebuild from a verified clean backup if contamination is widespread.
Rotate all credentials, including WordPress, database, SFTP, hosting, and API keys.
Patch the vulnerability that allowed access.
Scan, monitor, and verify before restoring public access.
Document what happened and update your checklist.

Microsoft notes that attackers may deploy malicious content into web directories using command-line techniques, so monitoring for suspicious file deployment—not only file creation—can improve detection.

Turn the checklist into ongoing protection

Web shell attacks are rarely a one-time event. The most resilient websites combine routine updates, restricted access, monitoring, backups, and a tested response process. For small businesses and WordPress owners, a managed maintenance and cybersecurity service can handle these tasks consistently—so vulnerabilities are patched, suspicious changes are investigated, and recovery does not depend on scrambling after an incident.

If your website handles customer inquiries, payments, bookings, or business-critical content, treat security as ongoing operations rather than a one-off cleanup. The cost of prevention is almost always lower than the cost of downtime, data loss, reputational damage, and emergency remediation.

Protect Your Website with Web Glaze

Do not wait for a malware warning, a defaced homepage, or a Google blacklist notification to take action. Web Glaze can help you implement this checklist, monitor your website for suspicious activity, maintain secure backups, and respond quickly if something goes wrong. Contact Web Glaze Services today for a website security and maintenance review. Their team can assess your WordPress or PHP website, identify high-risk gaps, and put an ongoing protection plan in place, so you can focus on running your business while experts focus on keeping your site secure.