B374k.php ((free)) | Must Read

The incident response team moved in. They identified b374k.php as a "True Positive" threat. Within minutes, the file was quarantined, the compromised plugin was patched, and the backdoor was slammed shut. Though the shell was gone, the team spent weeks scouring logs to see exactly what the "silent manager" had touched during its brief stay. GitHub - b374k/b374k: PHP Webshell with handy features

or even machine learning to identify the signature of a webshell even if it is hidden.

Using a WAF to block common exploit attempts that lead to webshell uploads. Regular Scanning: Employing tools that use Static Code Analysis