# Suspect Content In Files 1. [Home](https://mysites.guru/) 2. [Tools](https://mysites.guru/tools/) 3. [Files](https://mysites.guru/tools/file-information/) 4. Suspect Content In Files # Suspect Content In Files ![Suspect Content In Files](https://mysites.guru/_astro/suspect-content.BBvmLk8Q_ZL1Ljj.webp) This check reads the content of every file on your site against roughly 1,500 hack patterns and lists matches for you to read and judge, not confirmed hacks. Article Contents - [How the suspect content scan reads files](#how-the-suspect-content-scan-reads-files) - [Suspicion, not proof, by design](#suspicion-not-proof-by-design) - [Not a zero-length list](#not-a-zero-length-list) - [Reading each flagged line in context](#reading-each-flagged-line-in-context) - [Why a pattern match needs a person](#why-a-pattern-match-needs-a-person) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) ## How the suspect content scan reads files Suspect Content reads the content of every file in a Joomla site’s webspace, including image EXIF data and other non-text files, and matches it against a library of roughly 1,500 patterns built up over years of reviewing hacker uploads, poorly written code and insecure implementations. Anything that matches gets listed. That includes patterns you would expect, like obfuscated code and known backdoor signatures, and patterns that are broader than a single hack: every use of `eval()`, every direct call to `base64_decode`, every superglobal like `$_REQUEST` or `$_SERVER` used in a way that does not follow Joomla’s own API conventions, and every PHP file sitting inside an `/images/` folder, where nothing executable should ever live. ## Suspicion, not proof, by design This is the check that needs the most explaining, because its whole design depends on [a distinction most audit tools blur](https://mysites.guru/blog/suspect-content-vs-hacked-files/): the difference between Suspect Content and its sibling, Hacked Files. Hacked Files is certainty. A file lands there only when its hash matches a file already proven hacked, its filename is a known attacker signature, or the scan found direct evidence of a live compromise. There is nothing to read and nothing to judge; the verdict is already made. Suspect Content is the opposite, by design. A pattern match is a starting point, not a verdict. `eval()` is a legitimate PHP function that some frameworks and caching systems still use; `base64_decode` shows up in plenty of image-handling and encoding libraries that have nothing to do with an attacker. We flag them anyway, every time, because the cost of missing one real backdoor disguised as ordinary code is far higher than the cost of you spending a minute ruling out a false positive. **False positives here are expected, not a bug.** The point of the list is to turn “read every file on the site” into “read this much shorter list”, not to hand you a list of confirmed hacks. Files we are certain are hacked are never mixed into this list. They live in [Hacked Files](https://mysites.guru/tools/file-information/hacked-files/) instead, where every entry is a confirmed match with no ambiguity. Suspect Content is purely the heuristic, read-and-judge half of the pair. That split matters for triage order. If Hacked Files has anything in it, treat the site as compromised immediately; that is not a judgement call. Suspect Content is where you spend the time afterwards, working file by file, because among the false positives there may be a fresh backdoor we have not seen anywhere else yet and so cannot yet confirm by hash. ## Not a zero-length list The aim is not a zero-length list. On any real site running third-party extensions, a clean site can still return matches: a caching plugin using `eval()`, a legitimate script reading `$_SERVER` variables, an old `index.html` placeholder sitting somewhere odd. The aim is to understand what every file on the list actually contains, and to be able to say, file by file, why each one is there. If you have non-Joomla applications in the same webspace (phpMyAdmin, a second CMS, a staging copy) expect them to appear too, since they are not part of the Joomla install this check knows about. ## Reading each flagged line in context 1. **Open each flagged file and read the matched lines.** The check shows you exactly which line matched which pattern, so you rarely need to read the whole file. 2. **Check the file’s location and name against what you expect to find there.** A pattern match inside a well-known extension’s own code is usually the extension doing something ordinary; the same pattern inside a randomly named file in `/images/` is a different story. 3. **Compare against the original package** where you can. If the file is meant to be part of a Joomla core release or a specific extension version, download that version and diff it. 4. **Only install extensions and templates from reputable providers**, and where possible have someone who knows PHP review anything installed from a source you are not certain about. Most suspect content on a clean site comes from a poorly written or long-abandoned extension, not from an attack. 5. **If a file turns out to be malicious**, move to the cleanup process on the [Hacked Files](https://mysites.guru/tools/file-information/hacked-files/) page rather than deleting it in isolation, since one confirmed hack is usually evidence of more. ## Why a pattern match needs a person There is no one-click fix here, and there should not be: a pattern match needs a human to read it in context before anything is removed. There is also no whitelist or “mark as false positive” option; that feature existed once and was removed after a customer whitelisted a real hack and missed it. Reading every file’s content is part of [the full audit](https://mysites.guru/blog/security-audit-tools/) rather than the fast twice-daily snapshot, so this list refreshes on the site’s audit schedule, weekly by default, or daily or monthly if you have set it differently. Every match shows the exact lines that triggered it, and you can optionally run AI analysis with your own API key for a plain-English read of what a specific file does, if you have that enabled on your account. ## [Suspect Content In Files](https://mysites.guru/free-audit/?check=joomla/hacked/suspectcontent) mySites.guru checks every connected site for this automatically and flags it the moment it appears. These run as part of the full audit, which most sites schedule weekly. [Check your site for free](https://mysites.guru/free-audit/?check=joomla/hacked/suspectcontent) ## Further Reading - [Suspect Content vs Hacked Files](https://mysites.guru/blog/suspect-content-vs-hacked-files/) - the full comparison of both tools and how to triage between them. - [Security Audit Tools for WordPress & Joomla](https://mysites.guru/blog/security-audit-tools/) - where this check sits inside the wider audit. ## Frequently Asked Questions Show all Is everything in Suspect Content actually hacked? No, and it is not meant to be. This check matches file content against a library of roughly 1,500 patterns built from years of hacker uploads and insecure code, and it is deliberately broad. It flags every eval(), every base64\_decode, every PHP file sitting in an images folder, because those patterns turn up in genuine hacks far more often than in legitimate code. Reviewing a wide list is the trade-off for not missing the one file that matters. What is the difference between this and Hacked Files? Suspect Content matches on content: the file contains something that resembles a hack pattern, so it needs a human to read it and decide. Hacked Files matches on identity: the file's hash is byte-for-byte identical to a file already proven malicious, or its filename or behaviour is a known attacker signature, so there is nothing left to judge. See Suspect Content vs Hacked Files for the full comparison. [![EU icon: AI MODIFIED](https://mysites.guru/_astro/ai-modified.CaoawZEQ_1In0VX.webp)Written and edited by a human, with AI assistance. Our approach to AI](https://mysites.guru/ai-statement/) ### Article Contents - [How the suspect content scan reads files](#how-the-suspect-content-scan-reads-files) - [Suspicion, not proof, by design](#suspicion-not-proof-by-design) - [Not a zero-length list](#not-a-zero-length-list) - [Reading each flagged line in context](#reading-each-flagged-line-in-context) - [Why a pattern match needs a person](#why-a-pattern-match-needs-a-person) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) - **Published** - 28 August 2026 - **Applies to** - Joomla - **One-click fix** - Manual fix Share [](https://x.com/intent/post?url=https%3A%2F%2Fmysites.guru%2Ftools%2Ffile-information%2Fsuspect-content%2F&text=Suspect%20Content%20In%20Files)[](https://bsky.app/intent/compose?text=Suspect%20Content%20In%20Files%20https%3A%2F%2Fmysites.guru%2Ftools%2Ffile-information%2Fsuspect-content%2F)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmysites.guru%2Ftools%2Ffile-information%2Fsuspect-content%2F) Topics [Files](https://mysites.guru/tools/file-information/)Joomla ★★★★★ > "mySites.guru and Phil Taylor are my secret weapon. Always reliable, efficient and one step ahead of malicious gamers. I particularly like being able to [update components to all my websites](https://mysites.guru/blog/automatic-updates-for-any-joomla-extension/) directly from mySites.guru. I have and will continue to recommend this service to anyone doing [Joomla websites](https://mysites.guru/manage-multiple-joomla-sites/)." ![ROBERTO DE ALBA](https://mysites.guru/images/reviews/roberto-de-alba.webp) ROBERTO DE ALBAFounding Partner at Spliteye Multimedia LLC [](https://mysites.guru/reviews/) ## More checks in [Files](https://mysites.guru/tools/file-information/) - [ ### Check Files That Are Not Core Files Every file on your site that Joomla or WordPress did not ship in its own release. On a typical site that is thousands of files, most of them entirely normal. ](https://mysites.guru/tools/file-information/files-that-are-not-core-files/) - [ ### Files That Can Send Mass Email Every file on your Joomla site containing the word mail, the starting point for finding a hidden spam relay or mailing backdoor an attacker planted. ](https://mysites.guru/tools/file-information/files-that-can-send-email/) - [ ### Files That Can Upload Other Files Every file on your Joomla site that calls PHP's move\_uploaded\_file, the function behind both ordinary upload forms and the classic file-upload backdoor. ](https://mysites.guru/tools/file-information/files-that-can-upload/) - [ ### Hacked Files (100% Certain) A file appears here only when its hash matches a known hack, its name is unique to attacker uploads, or a live compromise was found on your site. ](https://mysites.guru/tools/file-information/hacked-files/) - [ ### Check Core Folders For Impostor Files Joomla ships a known, fixed set of files in every folder it owns. This check lists anything sitting in one of those folders that the CMS itself never put there. ](https://mysites.guru/tools/file-information/impostor-files-in-core-folders/) ## More from the blog [ ![Find Hacks and Backdoors in WordPress & Joomla](https://mysites.guru/_astro/19.DeHRsIdv_ZGCwsU.webp) ### Find Hacks and Backdoors in WordPress & Joomla Scan your WordPress and Joomla sites for malware, backdoors, and suspicious files. Hash-based detection and 1,500+ regex patterns. ](https://mysites.guru/blog/find-hacked-files-and-backdoors-in-joomla-and-wordpress/) ## See where your own sites stand One free audit of one site · no card · about 2 minutes to connect [Get Your Free Site Audit](https://manage.mysites.guru/en/register) [How the suspect content scan reads files](#how-the-suspect-content-scan-reads-files) [Suspicion, not proof, by design](#suspicion-not-proof-by-design) [Not a zero-length list](#not-a-zero-length-list) [Reading each flagged line in context](#reading-each-flagged-line-in-context) [Why a pattern match needs a person](#why-a-pattern-match-needs-a-person) [Further Reading](#further-reading) [Frequently Asked Questions](#faq)