“What’s a web shell?”
Most hacked websites have one or more web shell scripts added either during or after the site has been compromised.
Web shell scripts, sometimes called backdoor scripts, often include a visual interface that may be used to upload, rename, copy, move, or edit files. These scripts may likewise be used to view, edit, or download a website’s database.
Not all web shell or file manager scripts are malicious. A website designer may use these types of scripts legitimately to add administrator users to a WordPress website, edit theme files, or make website backups.
Backdoor scripts may be named anything, though, within a WordPress site, these types of scripts usually stand out from the core WordPress files. They may have file names like module.php, users.php, or have random letters like fnrt.php.
Below are examples of web shell scripting. Notice how some hacker scripts may be readable while others may be encoded or obfuscated? Either way, if a script’s code looks malicious, it probably is. Examples:
Why Is My Website Being Repeatedly Hacked?
Now that you have a better idea of what a web shell or backdoor script looks like, let’s discuss why your website might be repeatedly hacked.
With respect to WordPress. Hackers are often quite good at hiding their malicious scripts in places you might not think to look. For example, I often find web shell scripts within image directories or other directories not associated with WordPress.
If you believe your site is compromised, be sure to check whether other directories have been added within your website hosting account, outside of the usual wp-admin and wp-content, and wp-includes directories. See the example at right.
Likewise, if you have more than one WordPress website installed within your hosting account, assume all are hacked. An analogy I like to use with new clients: “If a burglar breaks into your house, is he likely going to just hang out in your kitchen, eat all your cookies, and then leave?”
Just like the hiding of scripts within unassociated directories, I’ve seen hackers compromise a hosting account using known script exploits within one WordPress installation but leave that website remarkably unscathed malicious-scripting wise. Why? The hackers’ general hope is that you’ll leave the apparently unhacked website alone and only clean up the obviously hacked WordPress installation. This leaves the hacker an “open window” for future attacks.
Let’s summarize what I’ve covered here today. First, nearly all hacked websites will have web shell scripts installed. These scripts allow the hacker ongoing access to your hosting account. And second, be aware that a hacker rarely hides these backdoor scripts in plain site, so be sure to consider every directory within your account as a potential hiding place.
Enjoy!
About malicious PHP code injection. Website redirection or malicious content injection is the most common symptom observed when a website is compromised. Malicious code or backdoor scripts may 
About malicious or edited posts. Blackhat SEO hackers may add or edit posts or pages to promote other websites or services.
About javascript code injection. Unlike malicious PHP code injections, malicious javascript code may be injected into 
nearly every type of file and into a website’s database tables as well. This poses a particular challenge for automated scanners, since javascript code may be compressed or encrypted in a variety of ways.
About WordPress feature manipulation. WordPress feature manipulation is another method hackers use to side-step automated scanners and malware removal services.
About web hosting company account changes. Because a website may be displaying all of the above three symptoms, one can’t discount that hackers may have gained access through the hosting company’s billing or site management control panels as well.
About damage to a website’s reputation. A number of online services like Google search, McAfee SiteAdvisor, Web 
of Trust, Norton Safe Web and others may both “index” manipulated content or mark a compromised website as malicious. Many of these services will not remove a bad reputation mark without a manual request for review.
