By the time a client calls to say their website is sending visitors to a pharmacy ad or a browser is flashing a red warning page, the compromise is usually weeks old. Attackers who get in rarely stop at one change, they plant a backdoor first, so they can come back even after the obvious problem gets cleaned up.

How common this actually is

Sucuri’s research, compiled in Colorlib’s 2026 WordPress security statistics roundup, recorded 422,466 SEO spam incidents and 175,520 malicious redirect incidents across WordPress sites in a single year, alongside 8,452 outright defacements. SEO spam is the quiet one: your site keeps working normally for you while search engines index hundreds of spam pages riding on your domain’s reputation.

What a backdoor is, and where it hides

Patchstack describes the pattern directly: a malicious plugin or compromised file can "infect your website with a backdoor and malicious administrator account", giving an attacker a way back in that survives a password reset. Backdoors commonly turn up in files named to look like core WordPress files but sitting in the wrong directory, or injected into wp-config.php and the plugins, themes and uploads folders.

Early warning signs

  • A security plugin or host flags unexpected file changes you did not make.
  • An admin account in Users that nobody on the team remembers creating.
  • Visitors reporting redirects to unrelated sites, or a browser warning when they load your pages.
  • New pages in Google’s index for products or topics your site has nothing to do with, a classic SEO spam symptom.

What to do about it

Any one of these is worth acting on immediately rather than waiting to see if it happens again: change every admin password, check the Users list for accounts you do not recognise, and bring in someone who can check the file system directly, since a backdoor by definition survives fixes that only touch the surface.

AuditMerlin will not scan your file system or database, its checks are limited to what a normal visitor’s browser can see, but version disclosure and exposed configuration files, two things it does check, are exactly the kind of fingerprinting that makes a site an easier target in the first place. A free scan is a reasonable companion check.