A web shell is the attacker’s foothold after exploiting a site: a file that executes whatever commands they send it — file manager, spam sender, pivot point for attacking the rest of the server.
Shells hide in writable directories (uploads, cache) under innocent names, and their code is obfuscated — eval of base64 blobs, hex-escaped function names, chr() chains. Detection therefore combines content signatures and location logic: PHP inside an uploads folder is suspect regardless of what it contains.
Frequently asked questions
How did a web shell get on my site?
Through a vulnerable plugin/CMS, a stolen FTP password or an insecure upload form. Removing the shell without patching the entry point guarantees reinfection.
Where do web shells usually hide?
In writable paths — uploads/, wp-content/uploads/, cache and tmp folders — where the web application itself is allowed to create files.