# Check Core Folders For Impostor Files 1. [Home](https://mysites.guru/) 2. [Tools](https://mysites.guru/tools/) 3. [Files](https://mysites.guru/tools/file-information/) 4. Check Core Folders For Impostor Files # Check Core Folders For Impostor Files ![Check Core Folders For Impostor Files](https://mysites.guru/_astro/impostor-files-in-core-folders.DMGGCEoj_Z1kXL3i.webp) Joomla ships a known, fixed set of files in every folder it owns. This check lists anything sitting in one of those folders that the CMS itself never put there. Article Contents - [How the core folder impostor check compares files](#how-the-core-folder-impostor-check-compares-files) - [Why a folder Joomla owns is exactly where attackers hide](#why-a-folder-joomla-owns-is-exactly-where-attackers-hide) - [Zero executables, everything else explained](#zero-executables-everything-else-explained) - [Triaging impostors by executable count](#triaging-impostors-by-executable-count) - [Why impostor files need your judgement](#why-impostor-files-need-your-judgement) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) ## How the core folder impostor check compares files Every release of Joomla ships a known, fixed set of files. Joomla 5.4.7 puts exactly one file directly in `/administrator/`, and that file is `index.php`. This check compares your site’s webspace against the exact file list for the Joomla version you are running, and lists anything sitting in a folder the CMS itself owns that the official release of that version never put there. It is narrower on purpose than a plain “everything that is not core” comparison. It only looks in the folders Joomla owns, where core is the legitimate occupant and there is far less reason for anything unexpected to be there, rather than every folder on the site. ## Why a folder Joomla owns is exactly where attackers hide A convincing backdoor is one that looks like it belongs. A file with a plausible name, sitting in a folder nobody has reason to open, several directories deep, survives far longer than one dropped somewhere obviously wrong. Folders the CMS itself owns are exactly the kind of place an attacker wants to hide, because most site owners never think to look there. The one thing an attacker cannot fake is the manifest. Joomla’s core file list for a given version is fixed and published, generated from the official release package, and it does not change unless you upgrade. A file sitting inside `/administrator/`, `/libraries/`, or another core-owned folder that is not on that list arrived some other way, and the files worth worrying about are the ones named to look like they belong: `index2.php` next to `index.php`, a `.php` file with a name close to a real Joomla class. This is a sharper version of [Files That Are Not Core Files](https://mysites.guru/tools/file-information/files-that-are-not-core-files/), which lists every non-core file anywhere on the site. That list is completely accurate and, on a typical site, close to unreadable: every extension you install adds files, so the count runs into the thousands and grows with completely normal use. This check narrows the same question down to the places where an unexpected file has the least excuse to exist. The manifest behind it is generated fresh from the official release package for your exact version, not a hardcoded folder list carried over from an older release. Core folders change shape between versions: files move, folders that used to hold several files are consolidated, and new folders appear. A static list would already be wrong by the next point release, which is why this check rebuilds its reference list to match the version your site is actually running each time it runs, rather than checking against a fixed idea of what a “typical” Joomla install looks like. ## Zero executables, everything else explained Zero executables. The executables count, meaning PHP and other program files sitting in a folder Joomla owns, should be zero on a healthy site. Measured across twelve real customer sites, it was zero on every one of them, so any non-zero result here is worth reading in full; see [Impostor Files: Backdoors In Core Folders](https://mysites.guru/blog/impostor-files-backdoors-in-core-folders/) for the full breakdown by Joomla version. The total count, which includes every kind of file rather than just executables, is normally much larger, commonly several hundred. Nearly all of it is ordinary: images you uploaded, language files that shipped with your extensions, empty `index.html` guard files left by older Joomla installs. None of that is hidden from you, because a hacker can write into those same folders too, so use the check’s own filters to hide the routine entries and see what is left. Some entries are your own hardening and belong there. If you use Admin Tools to password-protect your administrator folder, the `.htaccess` and `.htpasswd` files it creates will appear on this list. That is a feature working as intended, not a finding. ## Triaging impostors by executable count 1. **Open the tool and sort by the executables count first.** Anything above zero deserves an immediate look, before you touch the larger total. 2. **Read every `.php` or executable file the check lists.** A file Joomla never shipped, sitting in a folder Joomla owns, with no extension of yours accounting for it, is what a planted backdoor looks like. 3. **Use the filters to clear known-good entries** (your own uploads, extension language files, hardening files from tools like Admin Tools) so what remains is unexplained. 4. **Cross-check anything you cannot explain against [Files That Are Not Core Files](https://mysites.guru/tools/file-information/files-that-are-not-core-files/) and [Suspect Content](https://mysites.guru/tools/file-information/suspect-content/)**, since a single check rarely tells the whole story on its own. 5. **If you find a confirmed backdoor**, do not assume it is the only one; work through the cleanup steps on the [Hacked Files](https://mysites.guru/tools/file-information/hacked-files/) page rather than deleting it in isolation. ## Why impostor files need your judgement There is no one-click fix, because deciding whether an unexpected file is a hardening tool’s own work, a forgotten upload, or an attacker’s file needs a person to look at it. mySites.guru rebuilds the core file list for your exact Joomla version at the start of every audit and reports anything that does not match; if the file list itself cannot be downloaded for your version, the check reports no result at all rather than a false zero, because a zero should mean “we looked and found nothing”, not “we could not look”. ## [Check Core Folders For Impostor Files](https://mysites.guru/free-audit/?check=joomla/hacked/foreigncorefolderfiles) mySites.guru checks every connected site for this automatically and flags it the moment it appears. These run as part of the full audit, which most sites schedule weekly. [Check your site for free](https://mysites.guru/free-audit/?check=joomla/hacked/foreigncorefolderfiles) ## Further Reading - [Impostor Files: Backdoors In Core Folders](https://mysites.guru/blog/impostor-files-backdoors-in-core-folders/) - the full story behind this check, including the per-version file counts. - [Joomla release downloads](https://downloads.joomla.org/) - the official packages the core file list for each version is generated from. ## Frequently Asked Questions Show all What number should I react to first? The executables count: PHP and other program files sitting in a folder the CMS owns. Measured across twelve real customer sites it was zero on all twelve, so anything above zero on your site is worth opening immediately. The total count is usually much larger and mostly harmless, made up of your own uploads, extension language files and leftover placeholder files. Does this catch a backdoor hidden in a folder the attacker created themselves? Not on Joomla, and that is a deliberate limit rather than an oversight. Extensions legitimately install their own folders under /administrator/components/, so checking every folder beneath /administrator/ recursively would flag every extension you own. A file in a folder the attacker made is still caught by other checks, particularly Files That Are Not Core Files and the Suspect Content patterns. [![EU icon: AI MODIFIED](https://mysites.guru/_astro/ai-modified.CaoawZEQ_1In0VX.webp)Written and edited by a human, with AI assistance. Our approach to AI](https://mysites.guru/ai-statement/) ### Article Contents - [How the core folder impostor check compares files](#how-the-core-folder-impostor-check-compares-files) - [Why a folder Joomla owns is exactly where attackers hide](#why-a-folder-joomla-owns-is-exactly-where-attackers-hide) - [Zero executables, everything else explained](#zero-executables-everything-else-explained) - [Triaging impostors by executable count](#triaging-impostors-by-executable-count) - [Why impostor files need your judgement](#why-impostor-files-need-your-judgement) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) - **Published** - 28 August 2026 - **Applies to** - Joomla - **One-click fix** - Manual fix Share [](https://x.com/intent/post?url=https%3A%2F%2Fmysites.guru%2Ftools%2Ffile-information%2Fimpostor-files-in-core-folders%2F&text=Check%20Core%20Folders%20For%20Impostor%20Files)[](https://bsky.app/intent/compose?text=Check%20Core%20Folders%20For%20Impostor%20Files%20https%3A%2F%2Fmysites.guru%2Ftools%2Ffile-information%2Fimpostor-files-in-core-folders%2F)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmysites.guru%2Ftools%2Ffile-information%2Fimpostor-files-in-core-folders%2F) Topics [Files](https://mysites.guru/tools/file-information/)Joomla ★★★★★ > "A must have for webdesigners. Has [all tool one can imagine](https://mysites.guru/features/)." ![Carlo](https://mysites.guru/images/reviews/carlo.webp) CarloDigiwacht [](https://mysites.guru/reviews/) ## More checks in [Files](https://mysites.guru/tools/file-information/) - [ ### Check Files That Are Not Core Files Every file on your site that Joomla or WordPress did not ship in its own release. On a typical site that is thousands of files, most of them entirely normal. ](https://mysites.guru/tools/file-information/files-that-are-not-core-files/) - [ ### Files That Can Send Mass Email Every file on your Joomla site containing the word mail, the starting point for finding a hidden spam relay or mailing backdoor an attacker planted. ](https://mysites.guru/tools/file-information/files-that-can-send-email/) - [ ### Files That Can Upload Other Files Every file on your Joomla site that calls PHP's move\_uploaded\_file, the function behind both ordinary upload forms and the classic file-upload backdoor. ](https://mysites.guru/tools/file-information/files-that-can-upload/) - [ ### Hacked Files (100% Certain) A file appears here only when its hash matches a known hack, its name is unique to attacker uploads, or a live compromise was found on your site. ](https://mysites.guru/tools/file-information/hacked-files/) - [ ### Suspect Content In Files This check reads the content of every file on your site against roughly 1,500 hack patterns and lists matches for you to read and judge, not confirmed hacks. ](https://mysites.guru/tools/file-information/suspect-content/) ## More from the blog [ ![Find Hacks and Backdoors in WordPress & Joomla](https://mysites.guru/_astro/19.DeHRsIdv_ZGCwsU.webp) ### Find Hacks and Backdoors in WordPress & Joomla Scan your WordPress and Joomla sites for malware, backdoors, and suspicious files. Hash-based detection and 1,500+ regex patterns. ](https://mysites.guru/blog/find-hacked-files-and-backdoors-in-joomla-and-wordpress/) ## See where your own sites stand One free audit of one site · no card · about 2 minutes to connect [Get Your Free Site Audit](https://manage.mysites.guru/en/register) [How the core folder impostor check compares files](#how-the-core-folder-impostor-check-compares-files) [Why a folder Joomla owns is exactly where attackers hide](#why-a-folder-joomla-owns-is-exactly-where-attackers-hide) [Zero executables, everything else explained](#zero-executables-everything-else-explained) [Triaging impostors by executable count](#triaging-impostors-by-executable-count) [Why impostor files need your judgement](#why-impostor-files-need-your-judgement) [Further Reading](#further-reading) [Frequently Asked Questions](#faq)