A hacked Joomla or WordPress website is rarely infected by only one malicious file.

In many real incidents, the visible problem is only the beginning. A website may contain a hidden PHP webshell, an unknown administrator account, a modified template, a malicious плагин, database injections, scheduled reinfection tasks, suspicious redirects, SEO spam, fake login pages, hidden uploaders or several backup access points placed in different directories.

Deleting one suspicious file does not necessarily clean the website.

A complete recovery process must answer several critical questions:

1. How did the attacker gain access?
2. Which files, users and database records were changed?
3. Did the attacker create additional backdoors?
4. Are active administrator sessions still open?
5. Could another website under the same хостинг account be infected?
6. Is the website able to reinfect itself through cron jobs, scheduled events or hidden scripts?
7. Are the available backups genuinely complete and clean?
8. What protections must be installed before the website is made public again?

My Fiverr Cybersecurity Service for Joomla and WordPress websites is built around this complete incident-response approach.

I do not simply run an automatic scanner, remove the first detected file and declare the website safe. I investigate the website files, database, users, extensions, templates, плагины, scheduled processes, logs, server configuration, хостинг account and possible reinfection mechanisms.

The objective is to remove the infection, restore legitimate ownership, protect valuable content, identify the attack method where possible, reduce the attack surface and create a safer monitoring and backup strategy for the future.

Why Website Security Is More Difficult in the Age of AI

Artificial intelligence is helping businesses, developers and website owners work faster, but it is also being used to improve malicious operations.

Attackers can use automation and AI-assisted tools to create phishing messages, modify malicious code, scan websites for vulnerable extensions, generate convincing fake login pages, automate social engineering and produce different versions of malware designed to avoid simple signature detection.

The 2025 ENISA Threat Landscape identifies AI as an important and growing part of the modern threat environment. ENISA reports that AI is being used to optimise malicious activity, enhance phishing and automate social-engineering operations. (enisa.europa.eu)

This creates a major challenge for Joomla and WordPress owners because automated attackers do not care whether a website is large or small.

A small local-business website can still be used to:

• send spam;
• host phishing pages;
• redirect visitors;
• distribute malware;
• steal contact details;
• damage search rankings;
• create fake product pages;
• attack other servers;
• consume хостинг resources;
• damage the reputation of the website and domain.

Every public website is continuously exposed to automated scans, login attempts, vulnerability probes and malicious requests.

Security is no longer something that should be considered only after an infection. It must include prevention, monitoring, verified backups, controlled administrator access and a clear recovery plan.

First Steps for Any Website Owner Who Has Been Hacked

1. Stop Making Random Changes

Do not immediately delete every suspicious file reported by a scanner.

Some suspicious-looking files may be legitimate, while some harmless-looking files may be powerful webshells. Random deletion can damage the website and destroy evidence that could reveal how the attacker entered.

The first objective is containment and evidence preservation.

2. Avoid Repeated Administrator Logins

When administrator credentials may have been stolen, continuing to use Joomla Administrator or the WordPress dashboard can create additional risk.

The attacker may still have:

• a valid password;
• an active session cookie;
• a hidden administrator account;
• access to the registered email address;
• an installed browser-stealing tool;
• a backdoor that bypasses the normal login system.

Administrator access should be reviewed before normal management resumes.

3. Temporarily Restrict the Website

An active webshell allows the attacker to continue changing the website while cleanup is taking place.

Depending on the server и хостинг environment, I may:

• enable maintenance mode;
• deny public access;
• restrict the site by IP address;
• disable PHP execution temporarily;
• block the administrator directory;
• disable the affected virtual host;
• change webroot permissions;
• place the compromised account offline.

Containment prevents an attacker from continuing to operate the infection during the investigation.

4. Preserve Evidence

Before removing suspicious files, I create a protected incident directory and preserve useful information such as:

• suspicious files;
• file modification times;
• file ownership and permissions;
• SHA-256 hashes;
• web server access logs;
• error logs;
• database backups;
• administrator account lists;
• active session information;
• cron jobs;
• extension installation records;
• relevant Apache or Nginx configuration.

This evidence can reveal whether the attack originated from a stolen administrator password, a vulnerable extension, an exposed upload function or another compromised website under the same хостинг счет.

5. Create a Backup of the Infected State

An infected backup should never be treated as a clean restore point, but it is extremely valuable for investigation.

I normally preserve:

• the current database;
• suspicious files;
• access and error logs;
• extension lists;
• account lists;
• file metadata;
• relevant server configuration.

The backup is labelled clearly as an infected-state backup so it cannot be confused with a clean recovery copy.

6. Change Credentials from a Trusted Device

Important credentials may include:

• Joomla or WordPress administrator passwords;
• хостинг control panel passwords;
• SSH passwords or keys;
• FTP and SFTP accounts;
• database credentials;
• domain registrar credentials;
• DNS or Cloudflare credentials;
• email passwords;
• backup-service credentials;
• payment gateway keys;
• API keys stored by плагины.

Passwords must be unique. Reusing the same password across Joomla, WordPress, email, FTP and хостинг makes a second compromise far easier.

My Complete Joomla and WordPress Infection Investigation Checklist

Веб-сайт и Хостинг Environment Identification

Before cleaning anything, I identify the complete technical environment:

• website document root;
• Joomla or WordPress version;
• PHP version;
• database name and table prefix;
• хостинг user;
• Apache or Nginx configuration;
• reverse proxy configuration;
• caching systems;
• active extensions;
• active темы or templates;
• writable directories;
• recent updates;
• recently installed packages;
• other websites under the same хостинг счет.

This prevents incorrect assumptions and helps determine whether the infection is limited to one website or affects the whole account.

Recently Modified File Analysis

I generate detailed lists of recently created or modified PHP files, including:

• exact modification timestamp;
• size;
• owner;
• group;
• permissions;
• complete path.

This list is compared with administrator activity and web server logs.

Attackers often attempt to hide malware by copying an old timestamp to a new file. Therefore, an old modification date does not automatically prove that a file is legitimate.

Suspicious File Location Analysis

I pay special attention to executable files located in directories that should normally contain media, cache or temporary data.

Common locations include:

/images
/media
/uploads
/tmp
/cache
/logs
/templates
/темы
/плагины
/modules
/components
/administrator/components
/wp-content/uploads

A single executable file inside a writable directory can be enough to restore an entire infection.

Malware Signature and Behaviour Review

My investigation searches for suspicious functions and behaviours such as:

• eval;
• base64_decode;
• gzinflate;
• str_rot13;
• assert;
• shell_exec;
• exec;
• система;
• passthru;
• proc_open;
• command execution;
• remote file loading;
• dynamic function creation;
• hidden upload forms;
• encoded URLs;
• malicious redirects;
• long obfuscated strings.

These functions are not automatically malicious. Some legitimate applications use them. Every result must be reviewed in the context of its location, extension, modification time and expected purpose.

Webshell Detection

I investigate known and custom webshell patterns, including files based on:

• WSO;
• FilesMan;
• c99;
• r57;
• Tiny File Manager;
• custom one-line PHP shells;
• password-protected uploaders;
• fake Joomla modules;
• fake WordPress плагины;
• modified helper files;
• fake cache files;
• template-based file managers.

A webshell may allow the attacker to upload files, modify code, browse directories, execute commands and access databases without using the normal CMS login.

Database Infection Review

Malware is not limited to files.

I inspect databases for:

• injected JavaScript;
• iframe code;
• redirect rules;
• malicious options;
• fake плагин entries;
• SEO spam;
• altered site URLs;
• hidden administrator accounts;
• suspicious user permissions;
• unauthorised cron entries;
• encoded payloads;
• compromised widgets;
• modified template data;
• malicious metadata.

A website can remain infected after every suspicious PHP file is removed if the database continues to inject malicious content.

Joomla-Specific Infection Investigation

Super User and Administrator Review

I inspect all privileged Joomla accounts and record:

• user ID;
• name;
• username;
• email;
• registration date;
• last visit;
• block status;
• assigned user groups.

Unknown users are normally blocked first rather than deleted immediately.

Deleting a Joomla user does not usually delete their articles, forum posts, subscriptions or products, but it can leave orphaned database relationships. This may produce errors such as:

JUser: Unable to load user with ID

I developed custom Joomla database-reference tools that can locate every table and column still connected to a deleted user ID.

These tools can identify references in:

• Joomla articles;
• categories;
• K2 items;
• Kunena messages;
• EasyBlog posts;
• Membership Pro subscriptions;
• VirtueMart products;
• Quix pages;
• galleries;
• portfolio items;
• contact records;
• custom components.

When a legitimate user was deleted, I can restore the account from a trusted backup using its original numerical ID. This reconnects the existing content without transferring every article or forum message manually.

Joomla Extension Manager Investigation

An attacker with Super User access may use Joomla Extension Manager to install a fake module, overwrite an extension or upload a webshell.

I inspect:

• extension installation times;
• extension database records;
• missing manifest files;
• orphaned module entries;
• fake modules;
• suspicious package IDs;
• unexpected extension folders;
• disabled extensions that were recently installed;
• database records whose filesystem folders no longer exist.

A malicious Joomla module may remain visible in Extension Manager even after its files have been removed. In that case, the related database records must be cleaned carefully.

Joomla Template Manager Investigation

Joomla Template Manager can allow privileged users to modify template PHP files.

I check for:

• newly created template files;
• modified index.php files;
• fake info.php, helper.php или home.php files;
• edited Protostar files;
• unusual template styles;
• template-manager requests in the access logs.

A common attack sequence is:

1. log into Joomla Administrator;
2. install a malicious module;
3. open Template Manager;
4. create or modify a PHP file;
5. access the new webshell publicly;
6. upload more backdoors.

Joomla Endpoint Hardening

I have developed targeted Apache and Nginx protections for commonly abused Joomla endpoints and writable directories.

These can include protection for:

• JCE плагин.rpc;
• JCE profile imports;
• unauthorised raw requests;
• legacy Helix endpoints;
• NRFramework requests;
• SP Page Builder upload functions;
• Quix compiled-file functions;
• PHP files inside writable directories;
• exposed .git и .svn folders;
• suspicious feed requests;
• direct execution in temporary folders.

Rules are tested carefully so that legitimate frontend and administrator features continue to work.

Joomla Lock Method

For older Joomla websites that cannot be rebuilt immediately, I developed a Joomla Lock Method that can make sensitive parts of the installation read-only.

This method may:

• protect core files;
• assign sensitive files to root:root;
• lock configuration.php;
• lock primary entry files;
• keep only required cache and temporary folders writable;
• provide lock, unlock and status commands.

This does not replace updates or malware removal, but it can significantly reduce reinfection opportunities on older Joomla installations.

WordPress-Specific Infection Investigation

WordPress Core Integrity Verification

I compare WordPress core files against the correct official checksums for the installed version.

This helps identify:

• modified core files;
• missing files;
• unexpected files;
• injected code;
• fake WordPress files;
• altered loading or authentication files.

Core verification must be version-aware. Replacing files from the wrong WordPress version can create new problems.

Плагин и Theme Integrity Analysis

I inspect плагины и темы for:

• modified files;
• unexpected files;
• abandoned extensions;
• suspicious premium-плагин copies;
• fake updates;
• hidden file managers;
• malicious administrator creation;
• injected cron events;
• unauthorised remote connections.

When possible, a compromised плагин или тема is replaced with a trusted clean package rather than edited line by line.

WordPress Upload Protection

PHP files inside wp-content/uploads are a major warning sign.

I identify executable files in media directories and can add server-level rules that prevent PHP execution in folders intended only for images, documents and other uploads.

WordPress Cron Review

Malware may use scheduled events to recreate deleted files.

I review:

• WordPress cron events;
• Action Scheduler tasks;
• server cron jobs;
• suspicious remote requests;
• administrator-creation events;
• reinfection loops;
• scheduled payload downloads.

The website should not be considered clean until its persistence mechanisms have been removed.

Freespirits Security, Backup and Monitoring Tools

WP Malware Scanner Pro

Full product link:

WP Malware Scanner PRO

WP Malware Scanner Pro is one of the main tools in my WordPress cleanup workflow. It provides on-demand scanning for WordPress core, плагины, темы, uploads, unknown files and database content. It also includes core integrity checking, плагин и тема analysis, database scanning, user-security checks, cron inspection, file viewing, difference comparison and controlled cleanup actions. (Freespirits Web Hosting & Design)

The scanner is designed to give the administrator control rather than automatically deleting everything it detects.

It can assist with identifying:

• webshells;
• backdoors;
• encoded payloads;
• suspicious uploaders;
• modified core files;
• infected темы;
• infected плагины;
• hidden database scripts;
• rogue administrators;
• malicious scheduled jobs;
• SEO spam.

It is useful for developers, agencies, хостинг providers and professionals who need a more transparent malware-cleanup process.

JS PHP File Watcher

Full product link:

JS PHP File Watcher

JS PHP File Watcher is a Joomla security-monitoring плагин created to detect new or modified PHP-like files after a clean baseline has been established.

It can monitor .php, .phtml, .php3, .php4, .php5 и .phar files, send email alerts and run through cron on large installations. It also includes cache exclusions and logic designed to reduce false alerts on large Joomla websites. (Freespirits Web Hosting & Design)

This makes it particularly useful after:

• Joomla malware cleanup;
• restoration of clean core files;
• extension updates;
• permission hardening;
• removal of a webshell;
• rebuilding a compromised site.

A malware cleanup gives you a clean starting point. The file watcher helps you detect whether something changes again.

JDatabase Backup

Full product link:

JDatabase Backup

JDatabase Backup was developed to provide Joomla administrators with practical database backup and recovery management.

Its workflow can include:

• manual database backups;
• scheduled backups;
• configurable frequency;
• selected execution time;
• retention limits;
• automatic deletion of older backups;
• downloadable archives;
• backup verification;
• safer restoration testing.

A backup is useful only when it contains real table structures and records. During professional recovery, I do not trust an archive simply because it has a .sql.gz или .zip extension.

I validate:

• compressed-file integrity;
• uncompressed size;
• presence of CREATE TABLE;
• presence of INSERT INTO;
• correct database prefix;
• expected user tables;
• expected application tables;
• ability to import into a temporary database.

When only selected records are required, such as deleted Joomla Super Users, I can restore only the necessary user tables rather than overwriting the entire live database.

WP Guardian Angel

Full product link:

WP Guardian Angel

WP Guardian Angel is designed as an all-in-one WordPress protection and maintenance solution.

It combines:

• restore points before updates;
• optional automatic rollback;
• uptime monitoring;
• administrator alerts;
• login rate limiting;
• security hardening;
• security headers;
• health checks;
• white-label reports.

Its purpose is to help prevent common security and maintenance problems while also providing faster recovery when an update causes a website failure. (Freespirits Web Hosting & Design)

WP Guardian Angel is especially valuable after malware removal because post-cleanup protection must include more than a scanner. Login defence, restore points, health monitoring and controlled updates all contribute to long-term stability.

Password Locker

Full product link:

https://fspirits.com/fr/produit/password-locker

Password Locker is a Windows desktop password manager designed to keep important credentials inside a locally encrypted vault protected by a master password.

It includes:

• password generation;
• local encrypted storage;
• category organisation;
• live search;
• CSV import and export;
• vault backup and restore;
• master-password management;
• dark and light modes.

It is useful for website owners, developers and agencies that manage хостинг, Joomla, WordPress, FTP, domain, email and server credentials. (Freespirits Web Hosting & Design)

A strong cleanup can fail when the same compromised passwords are reused. Better credential organisation and unique passwords are essential parts of preventing another attack.

WPlus Offer Locker

Full product link:

https://fspirits.com/el/%CF%80%CF%81%CE%BF%CF%8A%CF%8C%CE%BD/wplus-offer-locker

WPlus Offer Locker is not a malware scanner, but it is part of the wider Freespirits security and access-control ecosystem.

It creates protected WordPress member areas and includes:

• customer authentication;
• password recovery;
• protected downloads;
• login-history tracking;
• download tracking;
• access suspension;
• automatic refund handling;
• WarriorPlus IPN integration.

These controls help digital-product vendors avoid placing paid files in publicly accessible folders and provide better visibility into customer access. (Freespirits Web Hosting & Design)

WP AI Agent

Full product link:

WP AI Agent

WP AI Agent is a WordPress-native AI assistant that can use approved business information, FAQs, pages, posts and WooCommerce data.

Its security-focused design principles include not inventing sensitive business information, using approved data sources and avoiding unnecessary storage of sensitive visitor information. (Freespirits Web Hosting & Design)

This is important because AI tools should not be added to a website without considering data exposure, permissions and reliability.

WP Sync Post to Multiple Sites AI SEO

Full product link:

WP Sync Post To Multiple Sites AI SEO

Это плагин supports controlled WordPress content synchronisation between websites and uses native WordPress authentication and direct site-to-site communication. (Freespirits Web Hosting & Design)

It is not a malware-removal product, but multi-site operators must understand every connection between their websites. A compromised synchronisation account can spread unwanted content, so secure credentials, strict permissions and careful endpoint management are essential.

WP Stats and ReadTime PRO

Full product link:

WP Stats And ReadTime PRO Plugin

WP Stats and ReadTime PRO provides local content-engagement information without requiring complicated external tracking systems. It supports unique-visit information, reading-time estimates, engagement analysis, maintenance controls and CSV export. (Freespirits Web Hosting & Design)

It can be useful after recovery when a website owner needs to verify whether normal traffic and reader engagement are returning after redirects, SEO spam or downtime have been resolved.

Безопасный Хостинг и Server Infrastructure

Freespirits Web Хостинг

Main хостинг page:

Web Hosting

Фриспириты хостинг services support Joomla and WordPress environments with SSL, backups, firewall protection, ModSecurity, migration assistance and technical support. (Freespirits Web Hosting & Design)

Available хостинг product links include:

Web Хостинг J
https://fspirits.com/product/web-hosting-j/

Web Хостинг M
https://fspirits.com/product/web-hosting-m/

Web Хостинг XL
https://fspirits.com/product/web-hosting-xl/

Сайт хостинг packages include server-level backup capabilities, SSL and security protections such as firewall and ModSecurity. (Freespirits Web Hosting & Design)

A clean website should ideally be hosted in an environment where:

• backups are maintained outside the public webroot;
• PHP versions are controlled;
• firewall rules are active;
• ModSecurity is properly configured;
• email reputation is monitored;
• SSL certificates are maintained;
• server logs are available;
• technical support can react quickly.

Cloud VPS Servers

Cloud VPS S:

Cloud VPS S – Linux Server

Cloud VPS XL:

Cloud VPS XL – Linux Server

A VPS can provide greater control over:

• Apache and Nginx;
• PHP-FPM pools;
• database services;
• firewall rules;
• ModSecurity;
• file permissions;
• scheduled backups;
• monitoring;
• audit logs;
• account isolation.

The Cloud VPS products include dedicated resources and backup capabilities, with server-management access through CWP7. (Freespirits Web Hosting & Design)

Additional Custom Security Techniques Used in My Service

Not every tool I use is sold as a standalone плагин. Several are custom scripts and investigation workflows developed through real Joomla, WordPress and server incidents.

These include:

• Joomla user-reference scanner;
• deleted-user restoration workflow;
• selective database-record recovery;
• database backup validator;
• MySQL and MariaDB definer repair;
• automated database backup scripts;
• configurable backup retention;
• website filesystem locking;
• PHP execution protection;
• quarantine and evidence preservation;
• recent-file reporting;
• suspicious-code analysis;
• access-log correlation;
• attacker-IP extraction;
• CSF firewall blocking;
• Cloudflare rule preparation;
• Nginx and Apache hardening;
• Joomla endpoint protection;
• WordPress uploads protection;
• ModSecurity exception analysis;
• PHP-FPM pool review;
• cron and scheduled-event analysis;
• auditd filesystem monitoring;
• Wazuh-based security monitoring;
• CWP7 server investigations;
• cross-account infection checks;
• recovery testing in temporary databases.

These techniques allow me to adapt the service to the actual incident rather than relying on a single generic scanner.

What My Fiverr Cybersecurity Service Can Include

Depending on the selected package and the condition of the website, the service may include:

Initial Assessment

I evaluate the visible symptoms, platform version, хостинг environment, access level, recent changes and available backups.

Containment

I restrict access, preserve evidence, block compromised users, remove active sessions and stop the attacker from continuing to use known webshells.

Malware Investigation

I inspect files, database content, users, плагины, extensions, темы, templates, uploads, logs and scheduled processes.

Cleanup

I quarantine malicious files, replace compromised core files, reinstall clean extensions, remove database injections, eliminate backdoors and remove reinfection mechanisms.

Account Recovery

I review privileged users, restore legitimate deleted accounts where appropriate, preserve original content ownership and reset compromised credentials.

Hardening

I apply appropriate Joomla, WordPress, Apache, Nginx, PHP, ModSecurity, firewall and permission protections.

Monitoring

I configure suitable tools such as WP Guardian Angel, WP Malware Scanner Pro, JS PHP File Watcher, server monitoring or backup automation.

Final Report

I provide a clear summary explaining:

• what was found;
• what was removed;
• what was repaired;
• which accounts were changed;
• which passwords must still be updated;
• which protections were added;
• what risks remain;
• what future maintenance is recommended.

What You Should Never Do After an Infection

Do not assume the website is safe because the homepage looks normal.

Do not:

• delete every scanner result automatically;
• restore an entire old database without testing it;
• reuse compromised passwords;
• leave unknown administrators active;
• ignore the database;
• ignore cron jobs;
• trust an untested backup;
• leave PHP executable in upload folders;
• keep outdated vulnerable extensions;
• rely only on blocking one attacker IP;
• put the website online before removing persistence;
• restore files from an infected archive;
• forget other websites under the same хостинг user.

A professional recovery must protect both the visible website and the systems behind it.

Final Website Security Checklist

Before a Joomla or WordPress website is considered ready to return online, confirm that:

• malware has been removed;
• webshells are quarantined;
• core files are verified;
• extensions and плагины are trusted;
• темы and templates are clean;
• unknown administrators are blocked or removed;
• legitimate users are restored safely;
• privileged passwords have been replaced;
• sessions have been deleted;
• cron jobs have been reviewed;
• database injections have been removed;
• upload directories are protected;
• backups have been tested;
• file permissions have been corrected;
• firewall protections are active;
• logging is enabled;
• monitoring is configured;
• the website has been tested;
• forms and email work correctly;
• redirects are gone;
• SEO spam has been removed;
• a fresh clean backup has been created.

Protect Your Joomla or WordPress Website Today

A website infection can damage customer trust, search visibility, email reputation, business operations and revenue.

The earlier the infection is contained, the easier it is to preserve evidence, recover legitimate content and prevent the attacker from creating additional backdoors.

My Fiverr Cybersecurity Service combines manual investigation, custom-developed tools, Joomla and WordPress knowledge, database recovery, server-level analysis, malware cleanup, hardening, backup validation and continuous monitoring.

Professional WordPress malware-removal service:

We will fix compromised WordPress sites, repair installations, and remove malware

Freespirits complete product catalogue:

https://fspirits.com/shop

The objective is not simply to make the homepage appear normal again.

The objective is to contain the attack, understand the infection, remove malicious access, preserve legitimate content, restore control to the owner, harden the website and create a safer long-term security strategy.