Why is this list so long?

Because every extension, plugin, theme and template you install adds files, and none of them are part of the CMS itself. Across the sites mySites.guru monitors, the median result on this check is over 13,000 files, and more than two thirds of sites return over ten thousand. The list is complete and accurate; it is simply not the same as a list of suspicious files.

Should I use this instead of the narrower core-folder check?

Use both, for different jobs. This check finds everything, anywhere on the site, including a file hidden in a folder an attacker created themselves, which the narrower Check Core Folders For Impostor Files check cannot see on Joomla. That narrower check is the one to open first, because its result set is small enough to actually read in full; use this list when you need the completeness the narrow check deliberately trades away.

Files That Are Not Core Files

What this check and mySites.guru tool looks at on your site

This check compiles a complete list of every file in your Joomla site’s webspace, then removes every file that the official Joomla release for your version distributes. What is left is every file that arrived by some other route: an extension you installed, a template you chose, a plugin, a language pack, or a file an attacker uploaded.

Unlike Check Core Folders For Impostor Files, which only looks inside folders Joomla itself owns, this check runs across the entire webspace with no folder limit. Nothing about where a file sits excludes it from this list.

Why the list runs to thousands of rows

This is the most complete file inventory the audit produces, and also the hardest one to read. It draws on the same file-hashing and classification pass that powers the wider hacked-file audit. Because every extension, plugin, theme and template you have ever installed adds files that are not part of core, the result set grows with completely normal, healthy use of the site. Measured across the sites mySites.guru audits, the median result on this check is over 13,000 files, and more than two thirds of sites return over ten thousand.

That is not a defect in the check. It is the honest answer to the question it asks, and the reason it exists alongside narrower, more targeted checks rather than instead of them. A list this size will contain every genuine backdoor an attacker planted, wherever they put it, including inside a folder they created themselves that a core-folder-only check cannot see. It will also contain the CSS file your template author wrote, the language file your form plugin shipped, and the cached thumbnail your gallery extension generated last week. Completeness and readability trade off against each other directly, and this check chooses completeness.

That is precisely why it is worth having alongside a narrower check like Core Folders For Impostor Files. That one only looks where Joomla itself owns the folder, which keeps its result small enough to actually read end to end, at the cost of missing a file an attacker hid inside a folder your own extensions created. This check catches what that one cannot see, anywhere on the site, at the cost of a list too long to read line by line. Used together they cover both the places worth checking first and the places nothing else reaches.

Nothing on it is a mystery to you

There is no target number, because a healthy Joomla site running normal extensions will always return a long list here. What “good” looks like is being able to account for the files on it: you recognise the extensions, templates and plugins that put them there, and nothing on the list is a mystery to you.

The value of this check comes from using it deliberately, not from scanning the raw list. Filter by file type to isolate executables (.php files in particular) from static assets like images and CSS, since a stray PHP file somewhere unexpected is worth far more attention than another image in an uploads folder. Filter by modification date to see what changed recently, since a hacker’s file is usually newer than the surrounding legitimate ones.

A file appearing here tells you only that it is not part of the official Joomla release, nothing more. It says nothing about whether you put it there deliberately, an extension put it there as part of a normal install, or an attacker did. That ambiguity is the trade-off for completeness, and it is also why this check works best as a source you search and filter rather than a report you read from top to bottom.

How to fix it

Filter to executable files first. .php, .phtml and similar files are the ones worth reading; static assets rarely hide anything dangerous.
Sort by modification date and look closely at anything modified more recently than the rest of the extension it claims to belong to.
Cross-reference against your installed extensions list. A file inside a folder matching an extension you actually run is usually accounted for; a file inside a folder with no matching extension is not.
Use the narrower Core Folders For Impostor Files check as your first pass, since its short, readable list catches the highest-risk locations without asking you to work through thousands of rows.
If you find something you cannot explain, check whether it also appears in Suspect Content or Hacked Files before deciding what to do with it.

What mySites.guru does about it

There is no one-click fix for this check, because the list by its nature includes files you deliberately added by installing extensions, and nothing here can tell those apart from something an attacker planted without a person reviewing them. mySites.guru compiles the full list on every audit and shows it alongside the narrower, faster-to-read checks so you can start with the small list and drop into this one only when you need to look somewhere those checks cannot reach.

Check Files That Are Not Core Files