Files

Files That Could Not Be Audited, Review Manually

Lists files our scanner timed out on, often large or complex scripts, so you know which parts of the webspace this audit did not actually cover.

Files Modified In Last Three Days

Lists every file changed in the last three days by its modification time, so a sudden burst of edits you did not make stands out fast.

Multiple .htaccess Files Located In Webspace

Counts .htaccess files across the whole webspace; a site needs one, so more than a handful outside the root is unusual and worth investigating.

File Permissions Of 777 Should Be Avoided

Finds files and folders set to permission 777, which lets any other user on a shared server read, write and execute them, not just your account.

PHP error_log Files Should Be Reviewed And Deleted

Finds PHP error_log files, which record file paths and code errors that a well-running site should not be generating, and that an attacker can read for reconnaissance.

Zend/ionCube Encrypted Files Should Be Avoided

Encoded PHP files hide their real source code from our scanner, so a Zend Guard or ionCube file could be running anything, including a backdoor.

Locate And Review Hidden Files ("dot Files", .DS_Store Etc)

Lists every file whose name starts with a dot, including .htaccess by design, because attackers also favour dot-prefixed names to stay off a normal file listing.

Locate And Review Archive Files (Zip, Tar.gz, Etc)

Finds zip, tar and gzip archives in your webspace, which take up space unnecessarily and are also how attackers bulk-upload a whole toolkit of files in one go.

Locate And Review Files Over 2Mb Size

Lists every file over 2MB so you can see what is actually using your disk space, since attackers also favour large archives to smuggle in many files at once.

Review Renamed Files (.old, .bak, .orig)

Finds files renamed with a .bak, .backup or .old ending, commonly a config file left with old credentials in it, or a copy of a hacked file kept for later.

PHP Files Should Not Be In These Certain Folders

Flags PHP files sitting inside the /images folder, a favourite hiding place for an uploaded backdoor because nobody expects code to run from there.

Locate And Review Any SQL Files That Are Publicly Available

Finds .sql files sitting in a publicly reachable location, which is how a full database backup, including password hashes, ends up downloadable by anyone.

"php.ini" and ".user.ini" Override Files Located In Webspace

Finds php.ini and .user.ini files that silently override PHP's settings for a single folder, worth knowing about even when you put them there yourself.

Identify Files With No Content (Zero Bytes In Size)

Finds files that exist but hold no data at all, sometimes a hacker's waymarker, sometimes a blank index.php stopping directory listings, so each needs a look.

Files Modified Between Audits

Compares the MD5 hash of every file against the previous audit and flags any that changed, catching edits that fall outside the three-day recent-changes window.

Files That Could Not Be Audited, Review Manually

Lists files our scanner timed out on, often large or complex scripts, so you know which parts of the webspace this audit did not actually cover.

Remove Unneeded Joomla Core "fluff"

Remove the left over core fluff files that Joomla installs, like build files, and text files for readmes etc.

Uploaded Tmp Files/Folders Should Be Removed

Finds leftover folders in Joomla's tmp directory from extension installs, which can contain PHP files that are still callable directly from a browser.

Akeeba Kickstart Should Not Be Left In Webspace

Kickstart is a one-time restore tool that can overwrite your entire site with any archive an attacker supplies, so leaving it in place after use is a standing takeover risk.

Files Modified In Last Three Days

Lists every file changed in the last three days by its modification time, so a sudden burst of edits you did not make stands out fast.

Forum Post Assistant Should Not Be Left In Webspace

The fpa.php diagnostic script dumps detailed system, PHP and configuration information that helps an attacker profile your server, so it should never stay public.

Multiple .htaccess Files Located In Webspace

Counts .htaccess files across the whole webspace; a site needs one, so more than a handful outside the root is unusual and worth investigating.

File Permissions Of 777 Should Be Avoided

Finds files and folders set to permission 777, which lets any other user on a shared server read, write and execute them, not just your account.

PHP error_log Files Should Be Reviewed And Deleted

Finds PHP error_log files, which record file paths and code errors that a well-running site should not be generating, and that an attacker can read for reconnaissance.

Zend/ionCube Encrypted Files Should Be Avoided

Encoded PHP files hide their real source code from our scanner, so a Zend Guard or ionCube file could be running anything, including a backdoor.

Locate And Review Hidden Files ("dot Files", .DS_Store Etc)

Lists every file whose name starts with a dot, including .htaccess by design, because attackers also favour dot-prefixed names to stay off a normal file listing.

Locate And Review Archive Files (Zip, Tar.gz, Etc)

Finds zip, tar and gzip archives in your webspace, which take up space unnecessarily and are also how attackers bulk-upload a whole toolkit of files in one go.

Locate And Review Files Over 2Mb Size

Lists every file over 2MB so you can see what is actually using your disk space, since attackers also favour large archives to smuggle in many files at once.

Review Renamed Files (.old, .bak, .orig)

Finds files renamed with a .bak, .backup or .old ending, commonly a config file left with old credentials in it, or a copy of a hacked file kept for later.

PHP Files Should Not Be In These Certain Folders

Flags PHP files sitting inside the /images folder, a favourite hiding place for an uploaded backdoor because nobody expects code to run from there.

Locate And Review Any SQL Files That Are Publicly Available

Finds .sql files sitting in a publicly reachable location, which is how a full database backup, including password hashes, ends up downloadable by anyone.

Locate And Review Any admintool_breaches.log Files

Finds admintool_breaches.log files written by the Admin Tools security extension when it blocks an attack, worth reviewing as a record of attempted break-ins.

"php.ini" and ".user.ini" Override Files Located In Webspace

Finds php.ini and .user.ini files that silently override PHP's settings for a single folder, worth knowing about even when you put them there yourself.

Identify Files With No Content (Zero Bytes In Size)

Finds files that exist but hold no data at all, sometimes a hacker's waymarker, sometimes a blank index.php stopping directory listings, so each needs a look.

Files Modified Between Audits

Compares the MD5 hash of every file against the previous audit and flags any that changed, catching edits that fall outside the three-day recent-changes window.

Identify Missing Core Joomla Files

Compares your webspace against the official Joomla file list and flags anything missing, whether from a failed update or deliberate deletion to cover tracks.

Locate And Review Double Extension Files (name.php.xxx)

Locate files where .php is not the final extension (name.php.json) - a common malware-evasion pattern

Files That Could Not Be Audited, Review Manually

Lists files our audit could not finish checking, usually because they exceeded your server's time limit or file size during the scan, so review them manually.

Files Modified In Last Three Days

Lists every file changed in the last three days by its modification time, so a sudden burst of edits you did not make stands out fast.

Multiple .htaccess Files Located In Webspace

Counts .htaccess files across the whole webspace; a site needs one, so more than a handful outside the root is unusual and worth investigating.

File Permissions Of 777 Should Be Avoided

Finds files and folders set to permission 777, which lets any other user on a shared server read, write and execute them, not just your account.

PHP error_log Files Should Be Reviewed And Deleted

Finds PHP error_log files, which record file paths and code errors that a well-running site should not be generating, and that an attacker can read for reconnaissance.

Zend/ionCube Encrypted Files Should Be Avoided

Encoded PHP files hide their real source code from our scanner, so a Zend Guard or ionCube file could be running anything, including a backdoor.

Locate And Review Hidden Files ("dot Files", .DS_Store Etc)

Lists every file whose name starts with a dot, including .htaccess by design, because attackers also favour dot-prefixed names to stay off a normal file listing.

Investigate And Remove /wp-content/debug.log

A world-readable debug.log from the WP_DEBUG_LOG setting can log database queries, file paths and PHP errors, handing a visitor detail about your internals.

Locate And Review Archive Files (Zip, Tar.gz, Etc)

Finds zip, tar and gzip archives in your webspace, which take up space unnecessarily and are also how attackers bulk-upload a whole toolkit of files in one go.

Locate And Review Files Over 2Mb Size

Lists every file over 2MB so you can see what is actually using your disk space, since attackers also favour large archives to smuggle in many files at once.

Review Renamed Files (.old, .bak, .orig)

Finds files renamed with a .bak, .backup or .old ending, commonly a config file left with old credentials in it, or a copy of a hacked file kept for later.

PHP Files Should Not Be In These Certain Folders

Flags PHP files sitting inside the /images folder, a favourite hiding place for an uploaded backdoor because nobody expects code to run from there.

Locate And Review Any SQL Files That Are Publicly Available

Finds .sql files sitting in a publicly reachable location, which is how a full database backup, including password hashes, ends up downloadable by anyone.

"php.ini" and ".user.ini" Override Files Located In Webspace

Finds php.ini and .user.ini files that silently override PHP's settings for a single folder, worth knowing about even when you put them there yourself.

Identify Files With No Content (Zero Bytes In Size)

Finds files that exist but hold no data at all, sometimes a hacker's waymarker, sometimes a blank index.php stopping directory listings, so each needs a look.

Files Modified Between Audits

Compares the MD5 hash of every file against the previous audit and flags any that changed, catching edits that fall outside the three-day recent-changes window.

Identify Missing Core WordPress Files

Compares your webspace against the WordPress core file list and flags anything missing, which can mean a broken upgrade or files deleted to hide a compromise.

Locate And Review Double Extension Files (name.php.xxx)

Locate files where .php is not the final extension (name.php.json) - a common malware-evasion pattern

Scan For Files Not Bundled With WordPress Core

Checks wp-admin and wp-includes, folders WordPress core owns exclusively, for files never shipped in a WordPress release and with no reason to be there.