lock360.php on WordPress: identify and remove the backdoor

Found a lock360.php file on your site? It's a backdoor. Here's what it does, where it hides and how to remove it without leaving a door open.

By WP-Detox 4 min read

You found a file named lock360.php in your WordPress install that you never created. First thing to know: it is not a legitimate WordPress or known-plugin file. It’s a backdoor — a hidden door the attacker dropped to regain control of your site whenever they want, without needing your password.

What is lock360.php?

lock360.php is a malicious PHP backdoor file. Once in place, it gives the attacker a permanent entry point: depending on the variant, it can run remote commands, upload more files to the server, create accounts or re-inject spam. The name lock360 matches no official WordPress component; its mere presence is a sign of compromise.

Like most modern backdoors, it doesn’t work alone. It’s part of a setup: one or more other backdoors, sometimes an unknown admin account, sometimes code injected into a theme. That’s what explains the classic scenario — you delete lock360.php, and two days later the site is infected again.

Associated symptoms

A site carrying this kind of backdoor often shows one or more of these signs:

No visible symptom doesn’t mean the site is clean: a backdoor can stay dormant for weeks before being used.

Where lock360.php hides

The attacker places the file where you don’t look and where WordPress checks nothing:

  • at the root of the site, among the real core files;
  • in wp-includes/, which should only hold official files;
  • in wp-content/uploads/, which should never contain PHP;
  • in wp-content/mu-plugins/, run automatically and invisible in the plugins list.

How to check if you’re infected

By hand / over SSH. Locate the file and any companions:

find . -name 'lock360.php'
find wp-content/uploads -name '*.php'
grep -rEl "eval\(|base64_decode\(|gzinflate\(" wp-content/ wp-includes/

Open each result before deleting: a backdoor is almost always unreadable, encoded code, with no plugin header, that executes external input ($_POST, $_GET, $_COOKIE).

With WP-Detox. Our free scan analyses the site remotely and surfaces out-of-place PHP files, injected code and persistence mechanisms, including random-named backdoors of this family.

Removing it properly

  1. Back up the current state first (files + database), for analysis and safety.
  2. Delete lock360.php and any other non-legitimate .php you found.
  3. Hunt for companions: a serious break-in rarely leaves a single door. Inspect mu-plugins, uploads, the root and the active theme’s functions.php.
  4. Reinstall core, plugins and themes from their official sources rather than patching file by file — the only way to be sure no backdoor remains. The detailed steps are in our guide on finding and removing a WordPress backdoor.
  5. Rotate every credential: admin, database, FTP/SFTP, host, and the salt keys in wp-config.php.

Deleting the file is never enough on its own: without closing the entry point, the site will be re-hacked.

How it comes back (persistence)

If you only remove lock360.php, the attacker reuses a companion backdoor or a scheduled task (cron) that recreates the file automatically. That’s why a real cleanup handles the whole set: every backdoor, rogue accounts, injected code and the original entry flaw — not just the file you happened to see.

FAQ

Is deleting lock360.php enough? No. lock360.php almost always comes with other backdoors and often a rogue admin account. If you delete just this one file without closing the entry point or hunting for companion files, the attacker regenerates everything within hours.

The file is empty or tiny — is it still dangerous? Yes. Many backdoors are only a few lines: they fetch the real malicious code from a remote server on every request. A small size doesn’t mean harmless.

How did lock360.php get onto my site? Almost always through a vulnerable plugin or theme, or stolen FTP credentials. The file is dropped after the initial break-in to keep permanent access, independent of your WordPress password.

At WP-Detox, removing backdoors like lock360.php and cutting their persistence is what we do. The scan is free, the cleanup takes about 30 minutes, it’s €149 excl. VAT and refunded if the site isn’t clean. For the big picture, start with the complete guide to cleaning a hacked WordPress.

Read next