Your first priority is to stop further damage. Temporarily place the website into maintenance mode or restrict public access while you investigate the compromise.

If possible, work with your hosting provider to isolate the affected hosting account.

Before deleting anything, preserve:

• Website files
• Database
• Server access logs
• Joomla logs
• Suspicious files
• Current configuration

Do not change only your Joomla administrator password. If an attacker gained access through another account, the website could be compromised again.

• Joomla Super User accounts
• Joomla administrator accounts
• Hosting / control panel accounts
• FTP / SFTP accounts
• SSH accounts
• Database users
• Administrative email accounts
• Domain registrar accounts
• CDN and security services
• Git or deployment services

Use unique passwords and enable two-factor authentication (2FA) wherever available.

Removing malware is only half of the recovery process. You also need to determine how the attacker gained access.

Check Joomla Core

An outdated Joomla installation may contain security weaknesses that have already been fixed in newer releases.

Install the latest compatible stable Joomla release available for your site and hosting environment.

Audit Third-Party Extensions

Review every installed:

• Component
• Module
• Plugin
• Template
• Page builder
• Editor
• Security extension
• Form extension

Remove extensions that are unused, abandoned, unsupported, or known to be vulnerable. Disabling a vulnerable extension may not remove compromised files.

Look for unexpected, recently modified, or suspicious files. Pay particular attention to important Joomla and server files.

• configuration.php
• .htaccess
• Joomla administrator files
• Template files
• Plugin files
• Component files
• Media and upload directories
• PHP files inside image directories
• Unknown JavaScript files
• Unexpected scheduled or cron scripts

Malware may be inserted into legitimate-looking files. A familiar filename does not automatically mean the file is safe.

Removing suspicious files does not necessarily remove every part of a compromise. Database content must also be reviewed.

• Unknown administrator accounts
• Unexpected user records
• Modified configuration values
• Injected JavaScript
• Spam links
• Hidden HTML
• Suspicious articles
• Modified menu items
• Unexpected extensions
• Malicious code stored in custom fields or modules

If you cannot confidently determine which Joomla files were modified, rebuilding from clean official files can be safer than manually searching every file for suspicious code.

1. Preserve evidence and backups.
2. Create a clean working environment.
3. Install a clean Joomla package.
4. Restore only verified configuration and data.
5. Reinstall trusted extensions and templates.
6. Update Joomla and all trusted extensions.
7. Scan and test the website.
8. Put the cleaned site back online.

Inspect important template files and customizations, including:

• index.php
• Template overrides
• Custom JavaScript
• Custom CSS
• PHP helper files
• Template framework files
• Third-party assets

If the template came from an unofficial source, replace it with a legitimate clean copy from the original developer.

Incorrect permissions can increase the risk of unauthorized modification. Avoid unnecessarily broad write permissions.

These are common examples, not universal requirements. Your exact permissions depend on the hosting environment, server software, ownership model, and Joomla configuration. Follow your host's recommendations where they differ.

Do not assume the website was the only affected system. Scan computers that have been used to access:

• Joomla administrator
• FTP / SFTP
• Hosting control panel
• SSH
• Domain registrar

If an attacker obtained credentials from an infected computer, cleaning the website without securing that computer can lead to reinfection.

Server logs can reveal useful clues about attacker activity and may help identify the initial compromise.

• Unknown POST requests
• Requests to unusual PHP files
• Repeated login attempts
• Requests targeting vulnerable extensions
• Unknown IP addresses
• File-upload attempts
• Suspicious administrator activity
• Unexpected cron jobs

Correlating timestamps between logs and recently modified files can help determine when the compromise started and which component may have been involved.

A hacked Joomla site can create SEO problems long after the visible defacement has disappeared.

• Google Search Console
• Indexed pages
• Search results
• Sitemap
• robots.txt
• Canonical URLs
• Redirects
• Spam pages
• Unexpected backlinks
• Malware and security warnings

Backups are extremely important, but a backup created after the compromise may already contain malicious files or database changes.

A strong backup strategy should include:

• Automated backups
• Off-site storage
• Multiple restore points
• Database backups
• File backups
• Regular restoration testing