Secure my server code/ find and remove backdoor access

My code for my web view app is being maliciously attacked. A previous developer created backdoor access to the code and is making changes for financial gain.

I think he has created code that ignores my server password but I need someone to locate the backdoor and shut it.