WordPress web shell (WSO, FilesMan, c99): recognise and remove it

A PHP file that shows a file manager in the browser? That's a web shell. Here's how to recognise WSO, FilesMan or c99 and remove them properly.

By WP-Detox 3 min read

You found a PHP file that, opened in the browser, shows a file manager or a console — often with a title like “WSO”, “FilesMan” or “c99”. That’s a web shell: one of the most dangerous tools an attacker can leave on your server. Remove it urgently and treat the site as fully compromised.

What is a web shell?

A web shell is a malicious PHP file that gives the attacker a server administration interface straight from the browser. Unlike a minimalist backdoor, a web shell is a complete tool: it lets them browse, read, edit and delete every file, run system commands, access the database, and often send mass mail. WSO (“Web Shell by Orb”), FilesMan, c99, r57, b374k or IndoXploit are names of widespread web shell families.

The web shell is usually the first tool dropped after a break-in: it’s from there that the attacker then installs the backdoors, injects the spam and sets up the redirects.

Symptoms

  • An unknown .php file that shows a file-management interface in the browser.
  • Files or pages appearing and disappearing without your action.
  • Abnormal server activity: mail sending, CPU spikes, unusual connections.
  • Other signs of compromise that follow: indexed spam, unknown admin account, redirects.

Where the web shell hides

  • In wp-content/uploads/, under a random or disguised name (a .php slipped in among images).
  • At the root or in wp-includes/, with a name close to a core file.
  • In wp-content/mu-plugins/, run automatically.
  • Sometimes disguised: .txt, .ico or double extension, called by another file.

How to check if you’re infected

Over SSH, search for known family names and out-of-place PHP:

grep -rEl "FilesMan|c99|r57|b374k|WSOshell|IndoXploit" . --include=*.php
find wp-content/uploads -name '*.php'
grep -rEl "\\\$_(POST|REQUEST|GET|COOKIE)\[" wp-content/ --include=*.php

The free WP-Detox scan remotely spots known web shells and PHP files dropped outside legitimate locations, including disguised ones.

Removing it properly

A web shell means the attacker had complete access: you don’t “repair”, you replace.

  1. Back up the current state for analysis.
  2. Delete the web shell and any non-legitimate .php in uploads and mu-plugins.
  3. Reinstall core, plugins and themes from their official sources — see reinstall the WordPress core and remove a backdoor.
  4. Hunt for companion backdoors: a web shell almost always installs some.
  5. Rotate every credential (admin, database, FTP, host, salt keys): the attacker likely captured credentials.
  6. Block PHP execution in uploads at the server level to prevent a new drop.

How it comes back (persistence)

The web shell is used to install persistence elsewhere: backdoors in the core, a cron that recreates files, a hidden admin account. Removing only the web shell leaves that whole setup in place, ready to drop a new one. That’s why a web shell’s presence demands a full cleanup — file replacement, backdoor hunt and credential rotation — not a simple deletion.

FAQ

Can a web shell do more than manage files? Yes, and that’s the problem. A web shell like WSO gives near-complete server access: browse and edit every file, run system commands, connect to the database, send spam mail. It’s one of the most dangerous tools an attacker can leave behind.

The web shell is password-protected — does that limit the damage? No. Many web shells are password-protected to stop other attackers using them, not to protect you. The shell’s owner keeps full access. Its presence is an emergency, protected or not.

How does a web shell get onto a WordPress site? Most often through an unfiltered upload form, a vulnerable plugin that lets a file be written, or stolen FTP/admin credentials. Once in place, the web shell is used to install everything else: backdoors, spam, redirects.

At WP-Detox, a web shell triggers a full cleanup: file replacement, backdoor hunt and rotation of every credential. The scan is free, the cleanup takes about 30 minutes, it’s €149 excl. VAT and refunded if the site isn’t clean. For the full walkthrough, see the guide to cleaning a hacked WordPress.

Read next