Compromised Joomla 3 website: a cleanup case examined
- Joomla
- July 1, 2026
Table of contents
In an intervention previously described on this blog, the hosting provider detected numerous malicious PHP files on a Joomla 3 website and restricted some hosting functions. The case helps explain why cleanup needs to extend beyond the first alert, without treating filenames as universal diagnostic criteria.
For initial priorities, read the guide to what to do first when a website has been hacked. This article distinguishes the reported findings from general criteria for planning recovery.
What was found on the Joomla website
The original account reported restrictions on PHP email sending and outbound connections to external services. The investigation identified webshells disguised with plausible names, including cache.php, in unusual and duplicated directory paths.
A webshell can allow operations on a server through web requests. In this case, the assessment concerned the files examined: a file named cache.php or a duplicated directory is not, by itself, evidence of malware.
The same applies to obfuscated code or functions such as base64_decode: their use, origin and context need examination. Suspicious code should be inspected without executing it.
Define the scope before starting cleanup
A list of files supplied by the host is a starting point. Core software, extensions, templates, overrides, data and privileged accounts also need checking. If other websites share the account, the provider should help assess that shared environment.
The available account does not document a confirmed initial cause, recovery times or the results of individual checks. It would therefore be inappropriate to attribute the incident to a particular extension or present a standard checklist as the complete chronology of the intervention.
The guide to assessing and recovering a compromised Joomla 3 site explains the investigation method and the distinction between evidence and hypotheses.
Criteria for recovering a compromised Joomla installation
The following table is an assessment framework, rather than a record of operations performed in this case.
| Stage | Criterion to verify |
|---|---|
| Containment | Restrict affected functions in coordination with the hosting provider. |
| Preservation | Keep the compromised copy separate from backups intended for recovery. |
| File analysis | Identify malicious changes without deleting files solely because of their names. |
| Restoration | Use trusted software packages and check files added outside those packages. |
| Extensions and data | Verify compatibility, recoverable content and customizations. |
| Access | Revoke compromised accounts and credentials, coordinating secret rotation. |
| Reopening | Test functionality and address external warnings after cleanup. |
Overwriting known files does not necessarily remove files added by an attacker. A scan with no detections does not, on its own, prove the absence of hidden access. Recovery needs to consider how the compromise could be reproduced.
Why Joomla 3 also requires a migration plan
Joomla 3 is an unsupported platform. Cleaning the installation does not restore project maintenance or move the website to a supported version.
Incident recovery and migration are related activities, but they require separate assessments. Do not overlay files from a new major version onto the existing installation: the database, extensions, templates and customizations require a compatible procedure.
Decide which trustworthy baseline can be recovered, which recent data must be preserved and how the destination system will be tested. Record any limitations that prevent establishing the cause or verifying the integrity of particular elements.
Checks to agree with the host before restoring services
Hosting restrictions can affect different functions. Before requesting their removal, check the pages originally flagged, administrative access and the affected sending or integration functions. Agree on the evidence the provider requires and who will handle subsequent monitoring.
If your host has restricted a Joomla website because of malware, I can assess Joomla cleanup and recovery using the reported files, available logs and existing backups as the starting point.
