Think Your Joomla
Site Has Been
Hacked?
Unexpected redirects, Google flagging your site, your host suspending the account. Start with the first fifteen minutes, then run a free file-level scan and find out exactly what is on your server.
The first fifteen minutes
Most of the lasting damage from a Joomla hack is not done by the attacker. It is done in the first hour by a panicking owner destroying the evidence. Work in this order.
Do this now
- 1
Take a full copy before you touch anything
Files and database, exactly as they are now, hack included. Keep it off the server. This is your evidence and your undo button, and you cannot recreate it once you start deleting.
- 2
Change every password, then change them again after the clean
Joomla Super Users, FTP and SSH, the database user, and your hosting control panel. Do it twice, because anything you rotate while a backdoor is still live can be captured and reused.
- 3
Take the site offline if it is serving malware to visitors
Joomla has an offline switch in Global Configuration. If Google has already flagged the site, or it is redirecting people to somewhere unpleasant, an offline notice costs you far less than the reputation damage.
- 4
Find out what is actually on the server
Not what your host emailed you, and not what a browser-based scanner reports from the outside. Every file, every line, including the extensions you deactivated years ago and forgot about.
Do not do this yet
Do not restore from a backup yet
This is the mistake that turns one hack into a recurring one. Restoring wipes the evidence of how they got in, and it puts the unpatched hole straight back. You will be reinfected, usually within days, and you will have nothing left to diagnose.
Do not delete files you have not read
A flagged file is a lead, not a verdict. Plenty of legitimate Joomla extension code uses the same functions attackers do. Read the matched lines first. One bad line can often be removed without deleting the whole file.
Do not assume your host has finished the job
Hosting providers remove the files their scanner recognises. They very rarely identify the entry point, and they almost never check your database. A clean bill of health from a host is not the same as a clean site.
Do not just update Joomla and hope
Updating closes the door for next time. It does nothing about the webshell already sitting inside, which will happily survive the update and let the attacker back in afterwards.
Useful if you need to send it to your host or your developer.
90,000+
sites protected
Since 2012
Joomla-native expertise
1,000,000+
site audits completed
Warning signs your Joomla site has been compromised
Most Joomla hacks are invisible to the site owner. The attackers want access, not visibility. Here is what they actually leave behind.
Backdoor Files in /components/ or /modules/
Attackers drop PHP shells and file uploaders into extension directories. They look like legitimate extension files but give remote access to your entire server.
Modified index.php or configuration.php
Core files that should never change. If index.php has been altered, there is almost certainly injected redirect code or malware loading on every page view.
Rewritten or Appended .htaccess
Attackers modify .htaccess to silently redirect mobile visitors or Googlebot to pharma spam sites while showing your real site to desktop users.
Unauthorised Extensions Installed
Malicious actors install rogue components or plugins with admin access. These persist across restores if you do not check the extension list before recovery.
SEO Spam & Hidden Links
Japanese keyword attacks, pharma hacks, and hidden link farms injected into your templates or database. Your rankings drop while Google indexes thousands of spam pages.
Obfuscated PHP in Template Files
Base64-encoded blobs and eval() chains buried inside your active template. Nearly invisible to manual inspection, but our scanner flags them immediately.
Quick check: is it actually hacked?
Tick anything you have seen. Nothing is sent anywhere, this runs entirely in your browser.
The toolkit you get for cleaning it yourself
One scan reads every file in your webspace, every line, including the dormant extension you deactivated in 2019. Out of that scan come two tools, and the difference between them is the difference between a lead and a conviction.
Suspect content: worth a look
The file's contents matched one of roughly 1,500 hand-written hack patterns, built from real compromises on real Joomla sites. That is a heuristic, not a verdict. False positives here are the design working, not failing, because attackers write in the same language as everyone else. A contact form uses the same mail function a spam script does.
The job of this tool is to take twenty thousand files and hand you a dozen worth reading. Click any one of them and you get the exact matched lines with line numbers, alongside the file's modification date, size and permissions.
Hacked files: act now
The file's full-file hash matches a file already confirmed as malicious. Identical hash means identical bytes, so your file is character for character the same as one that has already been examined and condemned. There is no maybe at this level. One important caveat: a file in this list means your site is compromised, not just that one file. Deleting it removes a symptom, not the way in.
What you can do to a flagged file, without an FTP client
Read the matched lines
Every pattern hit highlighted in place, with line numbers, so you can see what triggered it before deciding anything.
Edit it in place
Strip one injected line out of an otherwise legitimate file and save it straight back, in the browser.
Download it as evidence
Keep a copy of the webshell before you remove it. Useful later when you are working out the entry point.
Delete it
There is no confirmation step and no undo, which is deliberate. Read the file first. Deleting needs an active subscription or trial.
And the rest of the kit
AI analysis on a suspect file
Send a flagged file, or the whole list, for a safe, suspicious or malicious verdict with the problem lines called out. Verdicts are cached globally by file hash, so a popular extension's files have usually been analysed by someone already and come back instantly. This one needs your own Claude or OpenAI API key and has to be enabled on your account, so it is not switched on out of the box.
Bulk removal of attacker .htaccess files
A common Joomla hack drops a redirecting .htaccess into every folder on the site, which can run into thousands. One button removes every stray one and keeps your site root file and the known hardening files. Read how that works on a site with 9,000 of them, and why hardening .htaccess will not stop the hack in the first place.
Core file comparison and restore
Separate tools track changed and missing Joomla core files, with a byte-for-byte diff against the official original and a one-click revert to it. Restore is for core files, since that is the only case where a known-good original exists to restore from.
Files modified recently, and between audits
The fastest way to find a fresh compromise is to ask what changed. Establish a baseline and every later audit tells you what moved since, which also catches reinfection early.
Everywhere attackers like to hide
Dedicated checks for PHP executables sitting in your images folder, double extensions like invoice.php.jpg, hidden dot files, renamed leftovers, encrypted files, publicly readable database dumps, and stray archives.
Cleaning it yourself, in confidence order
A scan on a compromised site can return thirty flagged files, and staring at all thirty at once is how people give up. Work them in order of certainty instead. It turns one intimidating wall into three short queues, and the third is usually empty by the time you reach it.
- 1
Start with the confirmed hacked files
Anything in the hacked files list is an exact hash match against a known-malicious file. There is nothing to deliberate. Download a copy for evidence, then remove it, then keep going, because a confirmed file means the attacker got in somehow and that route is still open.
An empty list here is good news but not the all-clear. A backdoor dropped this morning that nobody has confirmed yet will be sitting in suspect content, not here.
- 2
Then work the suspect content list
Open each file and read the matched lines. You are asking three questions. Does this file belong to an extension you actually installed? Does its modification date match the rest of that package, or did it change alone at three in the morning? Is it a PHP file sitting somewhere PHP has no business being, like your images folder?
If AI analysis is enabled on your account, run it across the list first and it will sort most of them for you, leaving a handful marked suspicious for you to judge with context the model does not have.
- 3
Check the database-resident hacks
Run the five snapshot checks above. This is the step people skip, and it is the reason a site that was cleaned last week is defaced again today. If any of them find something, clean it, then patch the extension that allowed it, in that order.
- 4
Close the way in, then verify
Audit your user list for accounts you did not create. Restore any modified core files to their originals. Update every extension, and remove the ones you no longer use rather than leaving them deactivated, because a deactivated extension's files are still reachable over the web.
Then rescan. A clean second scan on a site you have just cleaned is the only evidence that you finished, and the baseline comparison will tell you immediately if anything moves afterwards.
For a longer walkthrough with screenshots at each step, see cleaning a hacked site with the suspect content and hacked files tools. For the mechanics of how the scan reads your files, see finding hacked files and backdoors, and for the difference between the two lists, suspect content vs hacked files.
Why cleaning by hand usually misses something
Cleaning a hacked Joomla site by hand is not hard because the code is clever. It is hard because of the arithmetic. A modest Joomla site is twenty thousand files. An attacker needs one of them to survive your cleanup, and they know that, which is why compromises come with more than one backdoor and why the spare is deliberately dull: a file named like a legitimate extension file, sitting in a directory full of legitimate extension files, dated to match its neighbours.
The second problem is that you are checking the places you can think of. A scan does not have that limitation, and it does not get bored on file eight thousand. It reads every line of every file, including the ones above your web root, the deactivated extensions, and the contents of files that are not even text.
We run over 3,000 audits a day and find more than 200 hacked sites a week. Every confirmed file feeds the hash list every other connected site is checked against tomorrow, so the same backdoor dropped on a hundred sites only has to be condemned once.
If you think you've manually cleaned your Joomla site of all hacked files, you're 100% wrong. This program is absolutely incredible, and it finds Every File that is hacked or suspect. The ability to view/edit/delete files right in the GUI is amazing, and a real time saver. If you're tired of fixing your site every few days, just spend the $25 for a 1 month subscription. Scan and fix everyday until all your problems are gone. Totally worth it! Using Mysites.guru is the only way you will know for sure your site is hack-free. This is the greatest security tool you can have. Thank you!
Read more reviewsOr hand the whole thing over
Everything above is genuinely doable yourself, and plenty of people do it. But if the site is a client's, and it went down this morning, and you have never read a webshell before, then the honest answer is that this is not the week to learn. There is a service for exactly that.
Phil cleans the site, updates it, locks it down and hands it back. Requests are screened before anyone commits to them, so if it cannot be fixed you are not charged.
- Usually resolved the same day
- Hacked site cleanup and hardening
- You are not charged if it cannot be fixed
- Non-subscribers get a free month of mySites.guru
mySites.guru is a great tool for working with cybersecurity on joomla. I'm not a cybersecurity engineer - i'm programer, but my team and I can easly find and fix problems. It's a really great tool.
Read more reviews
My joomla-site was hacked by 2 hackers that got in through an older version of JCE. Thanks to Phil my site was completely cleaned, updated and working again in less than 24 hours. Thx
Read more reviews
Phil really helped me out. Even though it was the weekend and I was feeling anxious, he responded right away. I was so relieved to hear that "the site is no longer being hacked." With my heartfelt gratitude!
Read more reviewsWhy most scanners miss Joomla hacks
Most services that advertise an audit are wrapping a remote scanner that looks at your site the way a browser does. It never sees your files. Anything below the rendered page is invisible to it.
It runs inside your own Joomla install
A connector plugin, listed in your Extensions Manager as the mySites.guru Secure Plugin, does the scanning on your own server against your own filesystem and database. Nothing but per-file metadata leaves the machine, and a file itself only leaves when you click to open it.
14 years of Joomla-specific threat data
This started in 2012 as the Joomla Health Checker, not as a generic tool that later added Joomla support. The patterns, the known-bad hashes and the hand-anchored filename shapes all come from real Joomla compromises, which is why the current extension exploitation waves get detection in the same week.
File integrity against genuine Joomla core
Clean checksums for every Joomla core version mean a single altered character in a core file is flagged, with a diff against the official original and a one-click restore. This is what catches the subtle backdoor that reads like ordinary Joomla code.
Detection that improves daily, not quarterly
Every confirmed hack on any connected site feeds the checks that run on your site tomorrow. Our own signatures are even stored obfuscated inside the connector so that server-side antivirus does not mistake our detector for the malware it describes, which has happened.
What the scan covers
- All files in /components/, /modules/, /plugins/, /templates/
- Joomla core files compared against known-clean versions
- .htaccess and .htpasswd files in all directories
- configuration.php and any configuration backup files
- All uploaded files in /images/ and /media/
- PHP files anywhere in the webspace, including above web root
- File contents line by line, including inside non-text files
- Admin and Super User list for unauthorised accounts
- Installed extension list for rogue components
- Template styles and menu parameters for injected payloads
One thing we do not claim: there is no general database malware scan. That is on the roadmap. What exists today is targeted detection for the specific database-resident compromises listed further up this page.
If the site held personal data, cleaning it is not the whole job
This is the part almost every hacked-site guide leaves out, and it matters most to the people most likely to be reading: agencies looking after someone else's site. If the compromised Joomla site processed personal data, and there is a realistic chance the attacker could reach it, then under UK and EU data protection law that is a personal data breach, and the clock on notifying the regulator is measured in hours rather than weeks. In the UK the obligation is to notify the ICO within 72 hours of becoming aware where the breach is likely to pose a risk to people.
Two practical consequences. First, it is another reason not to restore over the evidence: a decision about whether data was reachable is much harder to make once you have destroyed the only record of what was on the server. Second, if you are the agency rather than the site owner, you are probably the processor and not the controller, so the notification is your client's call and your job is to tell them promptly and in enough detail that they can make it.
None of this is legal advice, and the thresholds genuinely turn on specifics. Our own position on the data we hold is set out in the privacy notice and the data processing agreement.
The longer a hack goes undetected, the worse the damage
A backdoor file sitting quietly in your /components/com_users/ directory is not causing visible damage right now. That is the point. Attackers want long-term access, not immediate attention.
But every day that access persists is another day they can use your server to send spam, host phishing pages, inject links into your content, and accumulate Google penalties that take months to reverse. By the time the damage is visible, the cleanup cost is ten times higher.
Email blacklisting
Your server gets used to send thousands of spam emails. Your IP ends up on every major blacklist. Legitimate emails stop being delivered.
Google Search penalties
Google detects the spam content, flags your site as dangerous, and removes pages from the index. Recovering lost rankings takes months of clean-up work.
Customer data exposure
If your Joomla site handles user accounts, orders, or contact forms, a persistent backdoor means that data is accessible to the attacker indefinitely.
Hosting suspension
Shared hosting providers monitor for malicious activity. When they find it, they suspend the account first and ask questions later. Your site goes offline with no warning.
Born from the Joomla Health Checker in 2012
mySites.guru did not start out as a generic security tool that later added Joomla support. It started inside the Joomla community as the Joomla Health Checker, built specifically to inspect Joomla file structures, understand extension layouts, and detect the attack patterns that target Joomla specifically.
Fourteen years and over a million audits later, that knowledge is baked into every scan. We know which files should exist in a fresh Joomla 3.10 install versus 4.4 versus 5.3 versus 6.0. We have seen every variant of the Joomla-specific backdoors, template injections and database-level compromises that have emerged since 2012, including the Astroid Framework vulnerability and the current run of unauthenticated extension flaws.
When we scan your site we are not running generic pattern matches. We are applying more than a decade of Joomla-focused security research, most of it from finding these things on real sites first.
Launched as the Joomla Health Checker inside the Joomla community
Expanded to multi-site management as mySites.guru, adding WordPress support
Passed 500,000 audits completed across WordPress and Joomla sites
Joomla 4 supported from the day 4.0 went stable
Joomla 5 supported on release. Over 1,000,000 audits completed
Joomla 6 supported, with same-week detection for each new extension exploitation wave
Trusted by agencies looking after Joomla sites
mySites.guru is a great tool for working with cybersecurity on joomla. I'm not a cybersecurity engineer - i'm programer, but my team and I can easly find and fix problems. It's a really great tool.
Read more reviewsMy joomla-site was hacked by 2 hackers that got in through an older version of JCE. Thanks to Phil my site was completely cleaned, updated and working again in less than 24 hours. Thx
Read more reviewsPhil really helped me out. Even though it was the weekend and I was feeling anxious, he responded right away. I was so relieved to hear that "the site is no longer being hacked." With my heartfelt gratitude!
Read more reviewsCommon questions
Does this work with Joomla 3, 4, 5, and 6?
How long does the scan take?
What is the difference between suspect content and a confirmed hacked file?
Can I actually clean the site myself, or do I just get a report?
My site was defaced but no files were changed. How is that possible?
Do you scan the database for malware?
Can I mark a false positive so it stops appearing?
Is the scan really free?
Will the scan affect my live site?
What if I would rather someone else just fixed it?
The detail, post by post
Suspect content vs hacked files
Why they are two tools, and how to triage both in minutes
How the scan actually works
Pattern matching, hash matching, and what gets read
The defacement that lives in your database
Where the Helix3 payload hides, and why files look clean
Cleaned yesterday, exploited today
Dormant droppers and why one cleanup is rarely the end
Your .htaccess will not stop a Joomla hack
Why hardening the file is not the defence people think
AI malware analysis
Per-file verdicts, cached by hash across every subscriber
More ways mySites.guru protects your sites
Joomla Malware Scanner
File-level malware and backdoor scanning for Joomla
JCE Profiles Hack
Find and remove the JCE webshell compromise
Manage Multiple Joomla Sites
One dashboard for every Joomla site you look after
Joomla Agency Handbook
Running Joomla sites at scale without the firefighting
Free Site Audit
Find out what is on your server, at no cost
WordPress Site Hacked?
The same job, for a compromised WordPress site
Find out what is actually on your server
We have been scanning Joomla sites since 2012. Setting up takes about two minutes, the first scan is free, and you will see every flagged file with the reason it was flagged.
Scan Your Joomla Site Now