Shield: malware and backdoors
What distinguishes infection from a backdoor, what traces the scanner looks for, why malware returns after cleaning, and in what order to heal the site.
The two most serious categories of Shield are malware and backdoors. The difference is simple: the former works in the visitor's browser, while the latter gives the attacker access to the site itself. Here are almost all critical checks from the catalog.
Malware
- Embedded script. Foreign code in pages: redirects, content replacement, data collection.
- Payment data skimmer. A script that captures card numbers directly from the payment form — usually noticed by customer complaints rather than by the site.
- Miner. Uses the visitor's CPU; noticeable by device heating and complaints about slowdowns.
- Hidden iframe and hidden links. Invisible to humans inserts that work for someone else's promotion.
- Cloaking. The site shows one thing to the search robot and another to the visitor — a sure path to sanctions.
- Domain in blocklists. A sign that the infection has already been noticed externally.
Backdoors
| Find | What it is |
|---|---|
| Web shell | A file that allows command execution on the server via the browser |
| Modified core files | Foreign code added to the CMS system files |
| Unauthorized administrator | An account with full rights that no one created |
| Task in the scheduler | Regularly returns the infection after cleaning |
| Backdoor in .htaccess | Redirect rules that work only for the search robot |
| Suspicious upload | An executable file in the images folder |
Why the infection returns
Removing the malicious file is not enough: if a backdoor or a task in the scheduler remains, everything will return in a day. Therefore, the cleaning is done in a different order — first, close the entry point, then restore the files, and only then change the passwords.What to do when a find occurs
- Take a backup of the current state — it will be needed for analysis.
- Close the entry point: update the CMS and components, delete unnecessary accounts, check the scheduler.
- Restore core files from the official distribution, not "clean by hand".
- Change all passwords: admin panel, database, FTP, email — see leak analysis.
- Recheck the site and request a review in Search Console if a warning appeared there.
What this means for promotion
Promoting an infected site is pointless: links will lead to a page that search demotes or marks with a warning. First, healing, then links — this is also discussed in the article “Who PromoPilot is not suitable for”.
FAQ
What is the difference between a backdoor and malware?
Malware operates in the visitor's browser, while a backdoor gives the attacker access to the site itself and allows the infection to return.
Why does the infection return after cleaning?
Because an entry point remains: a backdoor, unauthorized administrator, or a task in the scheduler. First, close the entry, then restore the files.
Is it possible to promote an infected site?
There is no point: search demotes such pages and marks them with a warning. First, healing, then links.
Was this article helpful?
Thank you! We will consider this in future updates.
Try it on your project
Everything described in the article is available in the dashboard — the registration bonus is already in your balance.
Open dashboard