The problem
After a successful exploit, attackers drop a tiny PHP file — a web shell — that gives them remote control. It hides among thousands of legitimate files, often disguised with names like cache.php inside an uploads folder, and the code is obfuscated: hex escapes, chr() chains, base64_decode. By the time Google flags the domain or the server lands on spam blacklists, the backdoor has been there for weeks.
The solution
VpsMonitor.Pro’s Suspicious PHP functions check scans recently modified PHP files across all accounts on two levels. First, it looks for dangerous calls (eval, shell_exec, base64_decode, proc_open…) and obfuscation patterns — hex-escape runs, chr() chains, superglobals invoked as functions — and tags each hit with the reason it was flagged.
Second — and this catches what content scans miss — any PHP file inside an upload or writable directory (uploads/, images/, files/, wp-content/uploads/…) is graded red immediately, because PHP simply does not belong there, whatever its contents. Method calls like a PDO ->exec() are excluded, keeping false positives low.
The check runs on a schedule, colours the Security tile, and one click sends any result to AI for a verdict on whether a flagged file is malicious and what to do next.
Frequently asked questions
Why is a PHP file in an uploads folder always suspicious?
Upload directories are writable by the web application, which is exactly how attackers plant files. Legitimate code is deployed elsewhere — a PHP file appearing there is the classic signature of a backdoor.
Can the scan delete the malicious file?
No — detection is deliberately read-only. You review the flagged path (and the tags explaining why), then remove it and patch the entry point.
What should I do after removing a web shell?
Update the CMS and plugins, change the account’s passwords, and watch the same check over the following days — re-infection from a missed second shell is common.
Get a license · Download free — 7-day trial