Joomla 3, 4, 5 and 6. Free first scan.

Free Joomla Malware
Scanner That Reads
Every File

Not a URL crawl. The scan runs inside your own Joomla install and reads every file in your webspace, line by line, against pattern and hash lists built from real Joomla compromises since 2012.

Scan Your Joomla Site Free

No credit cardRead-only scanResults in minutes

Surface-level scanners cannot see malware

Most services advertising a free Joomla malware scan are doing one thing: fetching your pages over HTTP and looking at the result. That finds a defacement, because a defacement is deliberately visible. It finds nothing else, because everything else is deliberately not.

A webshell sitting in /modules/mod_banners/ is not linked from any page. It does not appear in your sitemap. It returns a blank response unless it receives the right parameter, which only the attacker knows. No amount of crawling your rendered HTML will ever reveal it. The only way to find that file is to read the files.

That is the difference here. A small connector plugin, listed in your Joomla Extensions Manager as the mySites.guru Secure Plugin, does the scanning on your own server against your own filesystem. It sees the deactivated extension you forgot about, the files above your web root, and the contents of files that are not even text.

How the scanner works

One pass over your webspace produces two lists, separated by how confident we are. That separation is the whole point.

Content matching: roughly 1,500 patterns

Every line of every file is matched against a library of hand-written patterns covering obfuscation idioms, backdoor structures and the code shapes that Joomla-targeting malware reuses. A hit means the file is worth reading, not that it is malicious. False positives are expected and the list is designed to be triaged, not trusted blindly.

Hash matching: confirmed malicious files

Each file's full-file hash is checked against a list of files already confirmed malicious. An identical hash means identical bytes, so there is no judgement call and no false positive. Every hash on that list earned its place through review before it got there.

Core integrity: clean checksums per version

Every Joomla core file is compared against the official original for your exact version. A single altered character is flagged, with a diff showing precisely what changed and a one-click restore back to the genuine file.

Filename and path rules

Around 130 hand-anchored filename and path shapes cover the dropper campaigns currently hitting Joomla sites: PHP in the images folder, double extensions, hidden dot-file shells, hex-named files in your web root, and polyglots wearing an image header.

Two separate mySites.guru tools listing suspect content and confirmed hacked files — Two lists, one scan. Suspect content is a lead. Confirmed hacked files is a fact.

Matched malicious lines highlighted inside a webshell with line numbers — A real webshell, with every matched line highlighted so you can judge it yourself.

What the scanner detects

Webshells and backdoors

PHP shells dropped into component, module and plugin directories, named to blend in with the legitimate extension files around them.

Obfuscated and packed code

Base64 blobs, eval chains, hex-escaped payloads and the packer fingerprints that malware families reuse, including inside files that are not text.

Modified Joomla core files

Every core file compared against clean checksums for your exact Joomla version, with a byte-for-byte diff and a one-click restore to the official original.

Redirect and cloaking rules

Attacker .htaccess files planted through your folder tree, sending mobile visitors or Googlebot somewhere else while your desktop view looks fine.

Mailers and upload handlers

Files capable of sending bulk mail or accepting uploads are flagged separately, because those are the two capabilities an attacker monetises first.

Dropper staging directories

The specific file and folder shapes used by the current Joomla extension exploitation waves, including polyglots disguised as images and case-mangled PHP extensions.

Malware that lives in your database rather than your files needs different checks, and those exist separately. If your site has been defaced but every file still matches its checksum, start at the hacked Joomla site page instead.

Built for Joomla from the start

This began in 2012 as the Joomla Health Checker, inside the Joomla community. It was not a generic PHP security product that later added Joomla support, which matters more than it sounds: the patterns, the hashes and the filename rules all come from real Joomla compromises, found on real Joomla sites, usually before they were public.

Fourteen years on, that shows up as speed of response. When an unauthenticated flaw in a popular Joomla extension starts being exploited at scale, detection for the specific files that campaign drops usually appears the same week, not the next quarter.

The detection data is also collaborative. We run over 3,000 audits a day and find more than 200 hacked sites a week. Every confirmed malicious file feeds the hash list that every other connected site is checked against on its next scan, so a backdoor dropped on a hundred Joomla sites only has to be identified once.

One small detail that says something about how carefully this has to be done: the malware signatures inside the connector are stored obfuscated and rebuilt at runtime, specifically so that server-side antivirus on your host does not mistake our detector for the malware it describes and quarantine it. That has happened, and we wrote about it.

What Joomla professionals say

Mike K

★★★★★

If you think you've manually cleaned your Joomla site of all hacked files, you're 100% wrong. This program is absolutely incredible, and it finds Every File that is hacked or suspect. The ability to view/edit/delete files right in the GUI is amazing, and a real time saver. If you're tired of fixing your site every few days, just spend the $25 for a 1 month subscription. Scan and fix everyday until all your problems are gone. Totally worth it! Using Mysites.guru is the only way you will know for sure your site is hack-free. This is the greatest security tool you can have. Thank you!

Common questions

Is the Joomla malware scanner free?

Yes. Connecting your first Joomla site and running a full scan costs nothing, with no credit card and no time limit. You get the complete results and the full toolset. Paid plans, from £19.99/month, add automated daily scanning and monitoring across multiple sites.

How is this different from a free online Joomla scanner?

An online scanner fetches your pages the way a browser does, so it only ever sees your rendered output. It cannot read the files on your server, which is where malware lives. This scanner runs inside your own Joomla install and reads every file on disk, including files that are never reachable from a URL.

Which Joomla versions are supported?

Joomla 3.x, 4.x, 5.x and 6.x. The scanner holds clean core checksums for every released version, so it knows exactly which files should exist in your install and which should not.

Does it scan my database for malware?

Not in general. General database malware scanning is on the roadmap rather than in the product, and we would rather say so plainly. What does exist is targeted detection for the specific database-resident Joomla compromises that occur in practice, such as payloads written into template style or menu parameters, each with a one-click clean. Those are covered on the hacked Joomla site page.

Will I get false positives?

Yes, by design. Pattern matching is deliberately inclusive because the alternative is missing the one real backdoor among twenty thousand files. Legitimate Joomla extension code uses the same functions attackers do. That is why matches go into a suspect list you review rather than being deleted automatically, and why confirmed hash matches are kept in a separate list where there is no ambiguity.

Can I remove what it finds, or does it only report?

You can act on it. For any flagged file you can read the matched lines with line numbers, edit it in place, download it as evidence, or delete it, all from the browser without an FTP client. Deleting requires an active subscription or trial, and there is no confirmation step, so read the file before you remove it.

Does the scan slow my site down?

No. The scan is read-only and runs in time-sliced chunks, adapting its pace to how much your host will tolerate, so it works on cheap shared hosting too. Visitors will not notice it running, and nothing is modified unless you click to modify it.

What leaves my server?

Per-file metadata, and a single file only when you click to open it. The pattern and hash lists are downloaded to your server and the matching happens locally, so your site content is not shipped elsewhere to be scanned.

Find out what is hiding in your Joomla site

Setting up takes about two minutes. The first scan is free, reads every file, and shows you the reason behind every flag.

Scan Your Joomla Site Free

No credit cardJoomla 3, 4, 5 & 6

Free Joomla Malware
Scanner That Reads
Every File

Surface-level scanners cannot see malware

How the scanner works