Check Core Folders For Impostor Files

What this check and mySites.guru tool looks at on your site

Every release of Joomla ships a known, fixed set of files. Joomla 5.4.7 puts exactly one file directly in /administrator/, and that file is index.php. This check compares your site’s webspace against the exact file list for the Joomla version you are running, and lists anything sitting in a folder the CMS itself owns that the official release of that version never put there.

It is narrower on purpose than a plain “everything that is not core” comparison. It only looks in the folders Joomla owns outright, where core is the legitimate occupant and there is far less reason for anything unexpected to be there, rather than every folder on the site.

Why a folder Joomla owns is exactly where attackers hide

A convincing backdoor is one that looks like it belongs. A file with a plausible name, sitting in a folder nobody has reason to open, several directories deep, survives far longer than one dropped somewhere obviously wrong. Folders the CMS itself owns are exactly the kind of place an attacker wants to hide, because most site owners never think to look there.

The one thing an attacker cannot fake is the manifest. Joomla’s core file list for a given version is fixed and published, generated from the official release package, and it does not change unless you upgrade. A file sitting inside /administrator/, /libraries/, or another core-owned folder that is not on that list arrived some other way, and the files worth worrying about are the ones named to look like they belong: index2.php next to index.php, a .php file with a name close to a real Joomla class.

This is a sharper version of Files That Are Not Core Files, which lists every non-core file anywhere on the site. That list is completely accurate and, on a typical site, close to unreadable: every extension you install adds files, so the count runs into the thousands and grows with completely normal use. This check narrows the same question down to the places where an unexpected file has the least excuse to exist.

The manifest behind it is generated fresh from the official release package for your exact version, not a hardcoded folder list carried over from an older release. Core folders change shape between versions: files move, folders that used to hold several files are consolidated, and new folders appear. A static list would already be wrong by the next point release, which is why this check rebuilds its reference list to match the version your site is actually running each time it runs, rather than checking against a fixed idea of what a “typical” Joomla install looks like.

Zero executables, everything else explained

Zero executables. The executables count, meaning PHP and other program files sitting in a folder Joomla owns, should be zero on a healthy site. Measured across twelve real customer sites, it was zero on every one of them, so any non-zero result here is worth reading in full; see Impostor Files: Backdoors In Core Folders for the full breakdown by Joomla version.

The total count, which includes every kind of file rather than just executables, is normally much larger, commonly several hundred. Nearly all of it is ordinary: images you uploaded, language files that shipped with your extensions, empty index.html guard files left by older Joomla installs. None of that is hidden from you, because a hacker can write into those same folders too, so use the check’s own filters to hide the routine entries and see what is left.

Some entries are your own hardening and belong there. If you use Admin Tools to password-protect your administrator folder, the .htaccess and .htpasswd files it creates will appear on this list. That is a feature working as intended, not a finding.

How to fix it

1. Open the tool and sort by the executables count first. Anything above zero deserves an immediate look, before you touch the larger total.
2. Read every .php or executable file the check lists. A file Joomla never shipped, sitting in a folder Joomla owns, with no extension of yours accounting for it, is what a planted backdoor looks like.
3. Use the filters to clear known-good entries (your own uploads, extension language files, hardening files from tools like Admin Tools) so what remains is genuinely unexplained.
4. Cross-check anything you cannot explain against Files That Are Not Core Files and Suspect Content, since a single check rarely tells the whole story on its own.
5. If you find a confirmed backdoor, do not assume it is the only one; work through the cleanup steps on the Hacked Files page rather than deleting it in isolation.

What mySites.guru does about it

There is no one-click fix, because deciding whether an unexpected file is a hardening tool’s own work, a forgotten upload, or an attacker’s file needs a person to look at it. mySites.guru rebuilds the core file list for your exact Joomla version at the start of every audit and reports anything that does not match; if the file list itself cannot be downloaded for your version, the check reports no result at all rather than a false zero, because a zero should mean “we looked and found nothing”, not “we could not look”.