Hack Detection
16 articles tagged Hack Detection, newest first.
The Fake Cloudflare Captcha Hiding in WordPress Core's functions.php
A fake Cloudflare captcha WordPress hack injected into wp-includes/functions.php, why a malware hash list can never match it, and how to clean it out for good.
Snapshot vs Audit: Settings Check or Full File Scan?
A mySites.guru snapshot reads your site's settings twice a day. An audit reads every file on a schedule. What each one finds, and why weekly beats daily.
How to Revoke Every Joomla API Token After a Hack
A Joomla password reset never touches API tokens. How to find and revoke every one after a hack, by hand on one site or in one click with mySites.guru.
How to Revoke Every WordPress Application Password After a Hack
A WordPress password reset never revokes Application Passwords. How to remove every one after a hack, one profile at a time or in one click with mySites.guru.
The Malware You Thought You Deleted - Is Still Running!
A site reinfected within seconds of cleaning it usually has a PHP process still running from a file you already deleted. How to find it and stop it.
A Backdoor Hides in Joomla's Scheduled Tasks Table
Joomla has run its own scheduler since 4.1. A task planted in that table has to look legitimate to run at all, which is why the task list never gives it away.
Five New Checks for WordPress Hacks a File Scan Cannot See
WP-Cron events, wp_options rows, drop-ins, hidden administrators and impostor plugins. Five new mySites.guru checks for the half of a hack that is not a file.
Impostor Files: How to find every file in a core folder that core never shipped
Joomla 5.4.7 ships exactly one file directly in /administrator/. Impostor Files lists everything else sitting in folders the CMS itself owns.
Finding Rogue Admin Accounts Across Every Joomla Site You Manage
Attackers plant admin accounts to walk back in after you clean the files. How to find rogue admins across every Joomla site you manage, from one screen.
Suspect Content vs Hacked Files: Two mySites.guru Tools, One Big Difference
mySites.guru now has two tools: Suspect content matches a file's content, Hacked files matches its hash. Learn the difference and triage your audit in minutes.
Astroid Framework Vulnerability - What Happened and How to Check Your Joomla Site
CVE-2026-21628 (CVSS 10.0) - Astroid Framework for Joomla had a critical auth bypass letting attackers upload backdoors. What happened and what to do.
AI-Powered Malware Analysis Now Available in mySites.guru
Send flagged suspect files to Claude or GPT for instant malware analysis. Crowdsourced cached results shared across all subscribers.
Find Hacks and Backdoors in WordPress & Joomla
Scan your WordPress and Joomla sites for malware, backdoors, and suspicious files. Hash-based detection and 1,500+ regex patterns.
Clean a Hacked Site with Suspect Content and Hacked Files
Use mySites.guru's Suspect Content and Hacked Files tools to find, confirm, and clean backdoors on a hacked Joomla or WordPress site, step by step.
Deep Security Audit for WordPress & Joomla
Surface-level scanners miss hidden malware. File-level audits check every line of code against 1,500+ patterns to find backdoors other tools miss.
Site Management Is More Than Just Updates
Real site management means security audits, best practice checks, and hack detection - not just bulk updates, backups, and uptime pings.