A hacked Joomla or WordPress website is rarely infected by only one malicious file.

In many real incidents, the visible problem is only the beginning. A website may contain a hidden PHP webshell, an unknown administrator account, a modified template, a malicious plugin, database injections, scheduled reinfection tasks, suspicious redirects, SEO spam, fake login pages, hidden uploaders or several backup access points placed in different directories.

Deleting one suspicious file does not necessarily clean the website.

A complete recovery process must answer several critical questions:

1. How did the attacker gain access?
2. Which files, users and database records were changed?
3. Did the attacker create additional backdoors?
4. Are active administrator sessions still open?
5. Could another website under the same l'hébergement account be infected?
6. Is the website able to reinfect itself through cron jobs, scheduled events or hidden scripts?
7. Are the available backups genuinely complete and clean?
8. What protections must be installed before the website is made public again?

My Fiverr Cybersecurity Service for Joomla and WordPress websites is built around this complete incident-response approach.

I do not simply run an automatic scanner, remove the first detected file and declare the website safe. I investigate the website files, database, users, extensions, templates, plugins, scheduled processes, logs, serveur configuration, l'hébergement account and possible reinfection mechanisms.

The objective is to remove the infection, restore legitimate ownership, protect valuable content, identify the attack method where possible, reduce the attack surface and create a safer monitoring and backup strategy for the future.

Why Website Security Is More Difficult in the Age of AI

Artificial intelligence is helping businesses, developers and website owners work faster, but it is also being used to improve malicious operations.

Attackers can use automation and AI-assisted tools to create phishing messages, modify malicious code, scan websites for vulnerable extensions, generate convincing fake login pages, automate social engineering and produce different versions of malware designed to avoid simple signature detection.

The 2025 ENISA Threat Landscape identifies AI as an important and growing part of the modern threat environment. ENISA reports that AI is being used to optimise malicious activity, enhance phishing and automate social-engineering operations. (enisa.europa.eu)

This creates a major challenge for Joomla and WordPress owners because automated attackers do not care whether a website is large or small.

A small local-business website can still be used to:

• send spam;
• host phishing pages;
• redirect visitors;
• distribute malware;
• steal contact details;
• damage search rankings;
• create fake product pages;
• attack other servers;
• consume l'hébergement resources;
• damage the reputation of the website and domain.

Every public website is continuously exposed to automated scans, login attempts, vulnerability probes and malicious requests.

Security is no longer something that should be considered only after an infection. It must include prevention, monitoring, verified backups, controlled administrator access and a clear recovery plan.

First Steps for Any Website Owner Who Has Been Hacked

1. Stop Making Random Changes

Do not immediately delete every suspicious file reported by a scanner.

Some suspicious-looking files may be legitimate, while some harmless-looking files may be powerful webshells. Random deletion can damage the website and destroy evidence that could reveal how the attacker entered.

The first objective is containment and evidence preservation.

2. Avoid Repeated Administrator Logins

When administrator credentials may have been stolen, continuing to use Joomla Administrator or the WordPress dashboard can create additional risk.

The attacker may still have:

• a valid password;
• an active session cookie;
• a hidden administrator account;
• access to the registered email address;
• an installed browser-stealing tool;
• a backdoor that bypasses the normal login system.

Administrator access should be reviewed before normal management resumes.

3. Temporarily Restrict the Website

An active webshell allows the attacker to continue changing the website while cleanup is taking place.

Depending on the serveur et l'hébergement environment, I may:

• enable maintenance mode;
• deny public access;
• restrict the site by IP address;
• disable PHP execution temporarily;
• block the administrator directory;
• disable the affected virtual host;
• change webroot permissions;
• place the compromised account offline.

Containment prevents an attacker from continuing to operate the infection during the investigation.

4. Preserve Evidence

Before removing suspicious files, I create a protected incident directory and preserve useful information such as:

• suspicious files;
• file modification times;
• file ownership and permissions;
• SHA-256 hashes;
• web serveur access logs;
• error logs;
• database backups;
• administrator account lists;
• active session information;
• cron jobs;
• extension installation records;
• relevant Apache or Nginx configuration.

This evidence can reveal whether the attack originated from a stolen administrator password, a vulnerable extension, an exposed upload function or another compromised website under the same l'hébergement compte.

5. Create a Backup of the Infected State

An infected backup should never be treated as a clean restore point, but it is extremely valuable for investigation.

I normally preserve:

• the current database;
• suspicious files;
• access and error logs;
• extension lists;
• account lists;
• file metadata;
• relevant serveur configuration.

The backup is labelled clearly as an infected-state backup so it cannot be confused with a clean recovery copy.

6. Change Credentials from a Trusted Device

Important credentials may include:

• Joomla or WordPress administrator passwords;
• l'hébergement control panel passwords;
• SSH passwords or keys;
• FTP and SFTP accounts;
• database credentials;
• domain registrar credentials;
• DNS or Cloudflare credentials;
• email passwords;
• backup-service credentials;
• payment gateway keys;
• API keys stored by plugins.

Passwords must be unique. Reusing the same password across Joomla, WordPress, email, FTP and l'hébergement makes a second compromise far easier.

My Complete Joomla and WordPress Infection Investigation Checklist

Site Web et Hébergement Environment Identification

Before cleaning anything, I identify the complete technical environment:

• website document root;
• Joomla or WordPress version;
• PHP version;
• database name and table prefix;
• l'hébergement user;
• Apache or Nginx configuration;
• reverse proxy configuration;
• caching systems;
• active extensions;
• active thèmes or templates;
• writable directories;
• recent updates;
• recently installed packages;
• other websites under the same l'hébergement compte.

This prevents incorrect assumptions and helps determine whether the infection is limited to one website or affects the whole account.

Recently Modified File Analysis

I generate detailed lists of recently created or modified PHP files, including:

• exact modification timestamp;
• size;
• owner;
• group;
• permissions;
• complete path.

This list is compared with administrator activity and web serveur logs.

Attackers often attempt to hide malware by copying an old timestamp to a new file. Therefore, an old modification date does not automatically prove that a file is legitimate.

Suspicious File Location Analysis

I pay special attention to executable files located in directories that should normally contain media, cache or temporary data.

Common locations include:

/images
/media
/uploads
/tmp
/cache
/logs
/templates
/thèmes
/plugins
/modules
/components
/administrator/components
/wp-content/uploads

A single executable file inside a writable directory can be enough to restore an entire infection.

Malware Signature and Behaviour Review

My investigation searches for suspicious functions and behaviours such as:

• eval;
• base64_decode;
• gzinflate;
• str_rot13;
• assert;
• shell_exec;
• exec;
• système;
• passthru;
• proc_open;
• command execution;
• remote file loading;
• dynamic function creation;
• hidden upload forms;
• encoded URLs;
• malicious redirects;
• long obfuscated strings.

These functions are not automatically malicious. Some legitimate applications use them. Every result must be reviewed in the context of its location, extension, modification time and expected purpose.

Webshell Detection

I investigate known and custom webshell patterns, including files based on:

• WSO;
• FilesMan;
• c99;
• r57;
• Tiny File Manager;
• custom one-line PHP shells;
• password-protected uploaders;
• fake Joomla modules;
• fake WordPress plugins;
• modified helper files;
• fake cache files;
• template-based file managers.

A webshell may allow the attacker to upload files, modify code, browse directories, execute commands and access databases without using the normal CMS login.

Database Infection Review

Malware is not limited to files.

I inspect databases for:

• injected JavaScript;
• iframe code;
• redirect rules;
• malicious options;
• fake plugin entries;
• SEO spam;
• altered site URLs;
• hidden administrator accounts;
• suspicious user permissions;
• unauthorised cron entries;
• encoded payloads;
• compromised widgets;
• modified template data;
• malicious metadata.

A website can remain infected after every suspicious PHP file is removed if the database continues to inject malicious content.

Joomla-Specific Infection Investigation

Super User and Administrator Review

I inspect all privileged Joomla accounts and record:

• user ID;
• name;
• username;
• email;
• registration date;
• last visit;
• block status;
• assigned user groups.

Unknown users are normally blocked first rather than deleted immediately.

Deleting a Joomla user does not usually delete their articles, forum posts, subscriptions or products, but it can leave orphaned database relationships. This may produce errors such as:

JUser: Unable to load user with ID

I developed custom Joomla database-reference tools that can locate every table and column still connected to a deleted user ID.

These tools can identify references in:

• Joomla articles;
• categories;
• K2 items;
• Kunena messages;
• EasyBlog posts;
• Membership Pro subscriptions;
• VirtueMart products;
• Quix pages;
• galleries;
• portfolio items;
• contact records;
• custom components.

When a legitimate user was deleted, I can restore the account from a trusted backup using its original numerical ID. This reconnects the existing content without transferring every article or forum message manually.

Joomla Extension Manager Investigation

An attacker with Super User access may use Joomla Extension Manager to install a fake module, overwrite an extension or upload a webshell.

I inspect:

• extension installation times;
• extension database records;
• missing manifest files;
• orphaned module entries;
• fake modules;
• suspicious package IDs;
• unexpected extension folders;
• disabled extensions that were recently installed;
• database records whose filesystem folders no longer exist.

A malicious Joomla module may remain visible in Extension Manager even after its files have been removed. In that case, the related database records must be cleaned carefully.

Joomla Template Manager Investigation

Joomla Template Manager can allow privileged users to modify template PHP files.

I check for:

• newly created template files;
• modified index.php files;
• fake info.php, helper.php ou home.php files;
• edited Protostar files;
• unusual template styles;
• template-manager requests in the access logs.

A common attack sequence is:

1. log into Joomla Administrator;
2. install a malicious module;
3. open Template Manager;
4. create or modify a PHP file;
5. access the new webshell publicly;
6. upload more backdoors.

Joomla Endpoint Hardening

I have developed targeted Apache and Nginx protections for commonly abused Joomla endpoints and writable directories.

These can include protection for:

• JCE plugin.rpc;
• JCE profile imports;
• unauthorised raw requests;
• legacy Helix endpoints;
• NRFramework requests;
• SP Page Builder upload functions;
• Quix compiled-file functions;
• PHP files inside writable directories;
• exposed .git et .svn folders;
• suspicious feed requests;
• direct execution in temporary folders.

Rules are tested carefully so that legitimate frontend and administrator features continue to work.

Joomla Lock Method

For older Joomla websites that cannot be rebuilt immediately, I developed a Joomla Lock Method that can make sensitive parts of the installation read-only.

This method may:

• protect core files;
• assign sensitive files to root:root;
• lock configuration.php;
• lock primary entry files;
• keep only required cache and temporary folders writable;
• provide lock, unlock and status commands.

This does not replace updates or malware removal, but it can significantly reduce reinfection opportunities on older Joomla installations.

WordPress-Specific Infection Investigation

WordPress Core Integrity Verification

I compare WordPress core files against the correct official checksums for the installed version.

This helps identify:

• modified core files;
• missing files;
• unexpected files;
• injected code;
• fake WordPress files;
• altered loading or authentication files.

Core verification must be version-aware. Replacing files from the wrong WordPress version can create new problems.

Plugin et Thème Integrity Analysis

I inspect plugins et thèmes for:

• modified files;
• unexpected files;
• abandoned extensions;
• suspicious premium-plugin copies;
• fake updates;
• hidden file managers;
• malicious administrator creation;
• injected cron events;
• unauthorised remote connections.

When possible, a compromised plugin ou thème is replaced with a trusted clean package rather than edited line by line.

WordPress Upload Protection

PHP files inside wp-content/uploads are a major warning sign.

I identify executable files in media directories and can add serveur-level rules that prevent PHP execution in folders intended only for images, documents and other uploads.

WordPress Cron Review

Malware may use scheduled events to recreate deleted files.

I review:

• WordPress cron events;
• Action Scheduler tasks;
• serveur cron jobs;
• suspicious remote requests;
• administrator-creation events;
• reinfection loops;
• scheduled payload downloads.

The website should not be considered clean until its persistence mechanisms have been removed.

Freespirits Security, Backup and Monitoring Tools

WP Malware Scanner Pro

Full product link:

WP Malware Scanner PRO

WP Malware Scanner Pro is one of the main tools in my WordPress cleanup workflow. It provides on-demand scanning for WordPress core, plugins, thèmes, uploads, unknown files and database content. It also includes core integrity checking, plugin et thème analysis, database scanning, user-security checks, cron inspection, file viewing, difference comparison and controlled cleanup actions. (Freespirits Web Hosting & Design)

The scanner is designed to give the administrator control rather than automatically deleting everything it detects.

It can assist with identifying:

• webshells;
• backdoors;
• encoded payloads;
• suspicious uploaders;
• modified core files;
• infected thèmes;
• infected plugins;
• hidden database scripts;
• rogue administrators;
• malicious scheduled jobs;
• SEO spam.

It is useful for developers, agencies, l'hébergement providers and professionals who need a more transparent malware-cleanup process.

JS PHP File Watcher

Full product link:

JS PHP File Watcher

JS PHP File Watcher is a Joomla security-monitoring plugin created to detect new or modified PHP-like files after a clean baseline has been established.

It can monitor .php, .phtml, .php3, .php4, .php5 et .phar files, send email alerts and run through cron on large installations. It also includes cache exclusions and logic designed to reduce false alerts on large Joomla websites. (Freespirits Web Hosting & Design)

This makes it particularly useful after:

• Joomla malware cleanup;
• restoration of clean core files;
• extension updates;
• permission hardening;
• removal of a webshell;
• rebuilding a compromised site.

A malware cleanup gives you a clean starting point. The file watcher helps you detect whether something changes again.

JDatabase Backup

Full product link:

JDatabase Backup

JDatabase Backup was developed to provide Joomla administrators with practical database backup and recovery management.

Its workflow can include:

• manual database backups;
• scheduled backups;
• configurable frequency;
• selected execution time;
• retention limits;
• automatic deletion of older backups;
• downloadable archives;
• backup verification;
• safer restoration testing.

A backup is useful only when it contains real table structures and records. During professional recovery, I do not trust an archive simply because it has a .sql.gz ou .zip extension.

I validate:

• compressed-file integrity;
• uncompressed size;
• presence of CREATE TABLE;
• presence of INSERT INTO;
• correct database prefix;
• expected user tables;
• expected application tables;
• ability to import into a temporary database.

When only selected records are required, such as deleted Joomla Super Users, I can restore only the necessary user tables rather than overwriting the entire live database.

WP Guardian Angel

Full product link:

WP Guardian Angel

WP Guardian Angel is designed as an all-in-one WordPress protection and maintenance solution.

It combines:

• restore points before updates;
• optional automatic rollback;
• uptime monitoring;
• administrator alerts;
• login rate limiting;
• security hardening;
• security headers;
• health checks;
• white-label reports.

Its purpose is to help prevent common security and maintenance problems while also providing faster recovery when an update causes a website failure. (Freespirits Web Hosting & Design)

WP Guardian Angel is especially valuable after malware removal because post-cleanup protection must include more than a scanner. Login defence, restore points, health monitoring and controlled updates all contribute to long-term stability.

Password Locker

Full product link:

https://fspirits.com/fr/produit/password-locker

Password Locker is a Windows desktop password manager designed to keep important credentials inside a locally encrypted vault protected by a master password.

It includes:

• password generation;
• local encrypted storage;
• category organisation;
• live search;
• CSV import and export;
• vault backup and restore;
• master-password management;
• dark and light modes.

It is useful for website owners, developers and agencies that manage l'hébergement, Joomla, WordPress, FTP, domain, email and serveur credentials. (Freespirits Web Hosting & Design)

A strong cleanup can fail when the same compromised passwords are reused. Better credential organisation and unique passwords are essential parts of preventing another attack.

WPlus Offer Locker

Full product link:

https://fspirits.com/el/%CF%80%CF%81%CE%BF%CF%8A%CF%8C%CE%BD/wplus-offer-locker

WPlus Offer Locker is not a malware scanner, but it is part of the wider Freespirits security and access-control ecosystem.

It creates protected WordPress member areas and includes:

• customer authentication;
• password recovery;
• protected downloads;
• login-history tracking;
• download tracking;
• access suspension;
• automatic refund handling;
• WarriorPlus IPN integration.

These controls help digital-product vendors avoid placing paid files in publicly accessible folders and provide better visibility into customer access. (Freespirits Web Hosting & Design)

WP AI Agent

Full product link:

WP AI Agent

WP AI Agent is a WordPress-native AI assistant that can use approved business information, FAQs, pages, posts and WooCommerce data.

Its security-focused design principles include not inventing sensitive business information, using approved data sources and avoiding unnecessary storage of sensitive visitor information. (Freespirits Web Hosting & Design)

This is important because AI tools should not be added to a website without considering data exposure, permissions and reliability.

WP Sync Post to Multiple Sites AI SEO

Full product link:

WP Sync Post To Multiple Sites AI SEO

Le présent plugin supports controlled WordPress content synchronisation between websites and uses native WordPress authentication and direct site-to-site communication. (Freespirits Web Hosting & Design)

It is not a malware-removal product, but multi-site operators must understand every connection between their websites. A compromised synchronisation account can spread unwanted content, so secure credentials, strict permissions and careful endpoint management are essential.

WP Stats and ReadTime PRO

Full product link:

WP Stats And ReadTime PRO Plugin

WP Stats and ReadTime PRO provides local content-engagement information without requiring complicated external tracking systems. It supports unique-visit information, reading-time estimates, engagement analysis, maintenance controls and CSV export. (Freespirits Web Hosting & Design)

It can be useful after recovery when a website owner needs to verify whether normal traffic and reader engagement are returning after redirects, SEO spam or downtime have been resolved.

Sécurisé Hébergement et Serveur Infrastructure

Freespirits Web Hébergement

Main l'hébergement page:

Web Hosting

Freespirits l'hébergement services support Joomla and WordPress environments with SSL, backups, firewall protection, ModSecurity, migration assistance and technical support. (Freespirits Web Hosting & Design)

Disponible l'hébergement product links include:

Web Hébergement J
https://fspirits.com/product/web-hosting-j/

Web Hébergement M
https://fspirits.com/product/web-hosting-m/

Web Hébergement XL
https://fspirits.com/product/web-hosting-xl/

Les l'hébergement packages include serveur-level backup capabilities, SSL and security protections such as firewall and ModSecurity. (Freespirits Web Hosting & Design)

A clean website should ideally be hosted in an environment where:

• backups are maintained outside the public webroot;
• PHP versions are controlled;
• firewall rules are active;
• ModSecurity is properly configured;
• email reputation is monitored;
• SSL certificates are maintained;
• serveur logs are available;
• technical support can react quickly.

Cloud VPS Servers

Cloud VPS S:

Cloud VPS S – Linux Server

Cloud VPS XL:

Cloud VPS XL – Linux Server

A VPS can provide greater control over:

• Apache and Nginx;
• PHP-FPM pools;
• database services;
• firewall rules;
• ModSecurity;
• file permissions;
• scheduled backups;
• monitoring;
• audit logs;
• account isolation.

The Cloud VPS products include dedicated resources and backup capabilities, with serveur-management access through CWP7. (Freespirits Web Hosting & Design)

Additional Custom Security Techniques Used in My Service

Not every tool I use is sold as a standalone plugin. Several are custom scripts and investigation workflows developed through real Joomla, WordPress and serveur incidents.

These include:

• Joomla user-reference scanner;
• deleted-user restoration workflow;
• selective database-record recovery;
• database backup validator;
• MySQL and MariaDB definer repair;
• automated database backup scripts;
• configurable backup retention;
• website filesystem locking;
• PHP execution protection;
• quarantine and evidence preservation;
• recent-file reporting;
• suspicious-code analysis;
• access-log correlation;
• attacker-IP extraction;
• CSF firewall blocking;
• Cloudflare rule preparation;
• Nginx and Apache hardening;
• Joomla endpoint protection;
• WordPress uploads protection;
• ModSecurity exception analysis;
• PHP-FPM pool review;
• cron and scheduled-event analysis;
• auditd filesystem monitoring;
• Wazuh-based security monitoring;
• CWP7 serveur investigations;
• cross-account infection checks;
• recovery testing in temporary databases.

These techniques allow me to adapt the service to the actual incident rather than relying on a single generic scanner.

What My Fiverr Cybersecurity Service Can Include

Depending on the selected package and the condition of the website, the service may include:

Initial Assessment

I evaluate the visible symptoms, platform version, l'hébergement environment, access level, recent changes and available backups.

Containment

I restrict access, preserve evidence, block compromised users, remove active sessions and stop the attacker from continuing to use known webshells.

Malware Investigation

I inspect files, database content, users, plugins, extensions, thèmes, templates, uploads, logs and scheduled processes.

Cleanup

I quarantine malicious files, replace compromised core files, reinstall clean extensions, remove database injections, eliminate backdoors and remove reinfection mechanisms.

Account Recovery

I review privileged users, restore legitimate deleted accounts where appropriate, preserve original content ownership and reset compromised credentials.

Hardening

I apply appropriate Joomla, WordPress, Apache, Nginx, PHP, ModSecurity, firewall and permission protections.

Monitoring

I configure suitable tools such as WP Guardian Angel, WP Malware Scanner Pro, JS PHP File Watcher, serveur monitoring or backup automation.

Final Report

I provide a clear summary explaining:

• what was found;
• what was removed;
• what was repaired;
• which accounts were changed;
• which passwords must still be updated;
• which protections were added;
• what risks remain;
• what future maintenance is recommended.

What You Should Never Do After an Infection

Do not assume the website is safe because the homepage looks normal.

Do not:

• delete every scanner result automatically;
• restore an entire old database without testing it;
• reuse compromised passwords;
• leave unknown administrators active;
• ignore the database;
• ignore cron jobs;
• trust an untested backup;
• leave PHP executable in upload folders;
• keep outdated vulnerable extensions;
• rely only on blocking one attacker IP;
• put the website online before removing persistence;
• restore files from an infected archive;
• forget other websites under the same l'hébergement user.

A professional recovery must protect both the visible website and the systems behind it.

Final Website Security Checklist

Before a Joomla or WordPress website is considered ready to return online, confirm that:

• malware has been removed;
• webshells are quarantined;
• core files are verified;
• extensions and plugins are trusted;
• thèmes and templates are clean;
• unknown administrators are blocked or removed;
• legitimate users are restored safely;
• privileged passwords have been replaced;
• sessions have been deleted;
• cron jobs have been reviewed;
• database injections have been removed;
• upload directories are protected;
• backups have been tested;
• file permissions have been corrected;
• firewall protections are active;
• logging is enabled;
• monitoring is configured;
• the website has been tested;
• forms and email work correctly;
• redirects are gone;
• SEO spam has been removed;
• a fresh clean backup has been created.

Protect Your Joomla or WordPress Website Today

A website infection can damage customer trust, search visibility, email reputation, business operations and revenue.

The earlier the infection is contained, the easier it is to preserve evidence, recover legitimate content and prevent the attacker from creating additional backdoors.

My Fiverr Cybersecurity Service combines manual investigation, custom-developed tools, Joomla and WordPress knowledge, database recovery, serveur-level analysis, malware cleanup, hardening, backup validation and continuous monitoring.

Professional WordPress malware-removal service:

We will fix compromised WordPress sites, repair installations, and remove malware

Freespirits complete product catalogue:

https://fspirits.com/shop

The objective is not simply to make the homepage appear normal again.

The objective is to contain the attack, understand the infection, remove malicious access, preserve legitimate content, restore control to the owner, harden the website and create a safer long-term security strategy.