How to Fix a Hacked Joomla Website: Malware Removal Guide

Signs Your Joomla Website Has Been Hacked

A hack isn't always obvious. Common signs include unexpected redirects to spam or adult sites, a "This site may be hacked" warning in Google search results, unfamiliar admin users, new files in your directories you didn't add, or a sudden spike in outbound traffic reported by your host. Sometimes there's no visible symptom at all until your hosting provider suspends your account for abuse.

Step 1: Don't Panic — Preserve Evidence First

Resist the urge to immediately delete suspicious files. Take a full backup of the site exactly as it is, including logs, before you change anything. If you need to identify how the attacker got in, this snapshot is often the only evidence you'll have.

Step 2: Take the Site Offline or Enable Maintenance Mode

Put the site in offline/maintenance mode to stop the malware from spreading further or continuing to serve spam content to visitors and search engines while you work.

Step 3: Scan for Malware and Backdoors

Compare your core Joomla files against a clean copy of the same version to spot modifications. Look specifically for:

• Unfamiliar PHP files in images/, media/, or template folders (common backdoor locations).
• Suspicious code appended to legitimate files, often using eval(), base64_decode(), or obfuscated strings.
• New or modified admin users you didn't create.
• Unrecognized scheduled tasks or cron jobs.

Step 4: Identify the Vulnerability

Cleaning the malware without finding the entry point just gets you reinfected. Check for the usual culprits: an outdated extension with a known CVE, weak or reused admin credentials, an exposed configuration file, or overly permissive file/folder permissions.

Step 5: Clean and Restore

Remove or replace every infected file. For core Joomla files, the safest approach is reinstalling clean copies of the exact version you're running. For custom code, manually review and strip any injected content rather than deleting the whole file if it's business-critical.

Step 6: Change All Credentials

Reset every password associated with the site: Joomla admin accounts, database user, FTP/SFTP, and hosting control panel. Assume anything the attacker could have read was read.

Step 7: Request Blacklist Removal

If Google, your host, or a browser has flagged your site, submit a review request through Google Search Console (Security Issues section) once you've confirmed the site is clean. This can take anywhere from a few hours to a few days to clear.

Preventing Future Attacks

Once the site is clean, harden it: enable two-factor authentication, keep core and extensions updated on a schedule, use a Joomla-specific firewall/security extension, and set up monitoring so you're alerted to suspicious file changes instead of finding out from a customer complaint.

When to Call in a Professional

If you're not confident diffing core files against a clean install, or the infection keeps coming back, it's time to bring in a Joomla security specialist. A proper clean-up closes the vulnerability, not just the symptom.