How to Recover a Hacked Joomla Site

What you'll need	Why
FTP/SFTP or hosting File Manager access	To inspect, replace, or delete infected files
phpMyAdmin or another database client	To search for and remove injected malicious SQL/JS
A recent, verified backup (if available)	Fastest and safest recovery path
Joomla Super User access (or ability to reset it via DB)	To restore admin control and manage users
A malware/security scanner (Sucuri SiteCheck, RSFirewall, SecurityCheck Pro)	To locate infected or backdoored files

Even a well-maintained Joomla site can get hacked — through an outdated extension, a leaked password, or an unpatched core vulnerability. What matters most is what you do in the first hour. This guide covers Joomla 5.4.x and 6.1.x (current stable as of July 2026), and walks through isolating the site, removing the infection, and hardening it so it doesn't happen again.

🖼️ [ẢNH CẦN CHỤP — HERO] Overview graphic or screenshot representing "hacked Joomla site recovery" — e.g. Joomla admin dashboard with a security warning banner visible.

Step 1: Identify the Signs of a Hacked Joomla Site

Before doing anything else, confirm the site is actually compromised:

• 🚨 Unexpected redirects or pop-ups on the front end
• 🔐 Admin lockout, or new/unknown Super User accounts in Users → Manage
• ⚠️ A "This site may be hacked" warning in Google Search results or Search Console
• 💀 Unknown files in the root or /tmp, sudden slowdowns, or unfamiliar PHP errors
• 📧 Reports of spam email being sent from your domain

Step 2: Put the Site in Maintenance Mode

Isolate the site immediately to stop further damage or data theft:

1. In Joomla, go to System → Global Configuration → Site and set Site Offline to "Yes".
2. Or, for tighter isolation, restrict access via .htaccess so only your IP can reach the site during cleanup:

Order deny,allow
Deny from all
Allow from 123.123.123.123

🖼️ [ẢNH CẦN CHỤP — BƯỚC 2] Joomla admin, System → Global Configuration → Site tab, with the "Site Offline" toggle set to Yes, circled in red.

Step 3: Back Up the Infected Site Before Cleaning

Counterintuitive, but important: back up the hacked state first, so you can do forensic analysis later if needed.

• Use Akeeba Backup to export a full site + database archive.
• Save the archive locally — never leave it on the same server.

Step 4: Scan for Malware and Modified Files

Identify what was actually compromised before you start deleting or restoring anything:

• Sucuri SiteCheck — free external scan for blacklisting and known malware signatures
• SecurityCheck Pro — detects injected code, backdoors, and altered core files from inside Joomla
• RSFirewall — performs deep file integrity scans against Joomla's official checksums

📊 [ẢNH CẦN CHỤP — BƯỚC 4] Scan results dashboard from Sucuri SiteCheck or SecurityCheck Pro, showing a list of flagged/infected files.

Step 5: Compare Against a Clean Joomla Installation

Download the exact same Joomla version from the official Joomla downloads page, then diff it against your live installation:

diff -rq /var/www/html /var/www/clean-joomla/

Replace any modified, unknown, or unexpected core files with the originals from the clean copy. Pay special attention to files with recent modification timestamps that you didn't personally change.

Step 6: Restore From a Clean Backup (If Available)

If you have a verified backup from before the compromise, restoring it is usually the fastest and safest path back online.

• Scan the backup locally first — don't restore an already-infected backup.
• After restoring, immediately change all database, admin, and FTP passwords.

Step 7: Clean the Database

Hackers frequently inject malicious scripts or links directly into Joomla's database content fields.

1. Access your database via phpMyAdmin (or your host's DB client).
2. Search article, module, and template tables for suspicious patterns such as iframe, base64_decode, or eval(.
3. Remove malicious entries carefully, or restore the affected tables from a clean SQL dump.

🖼️ [ẢNH CẦN CHỤP — BƯỚC 7] phpMyAdmin search query panel with a "base64_decode" or "eval(" search term run against the Joomla articles/content table.

Step 8: Change All Passwords and API Keys

Assume every credential on the server was exposed:

• 🔑 Reset all Joomla user passwords — Super User accounts first.
• 🔐 Change hosting control panel, FTP/SFTP, and database credentials.
• 🚫 Revoke and regenerate API keys for any connected extensions or services.

🖼️ [ẢNH CẦN CHỤP — BƯỚC 8] Joomla Users → Manage screen with a Super User account selected and the "Reset Password" action highlighted.

Step 9: Update Joomla Core and Extensions

Outdated software is the single most common entry point for Joomla hacks. Once the site is clean:

1. Update Joomla core to the latest stable release (6.1.x or 5.4.x — check Joomla release news for the current version).
2. Update every installed extension and template.
3. Uninstall any plugin, module, or component you're no longer using — a disabled extension can still be exploited if its files remain.

🖼️ [ẢNH CẦN CHỤP — BƯỚC 9] Joomla System → Update → Joomla screen showing an available core update, with the "Update" button visible.

Step 10: Ask Google to Review the Site

If Google flagged the site as hacked in Search results, cleanup alone won't remove the warning automatically.

1. In Google Search Console, go to Security & Manual Actions → Security Issues.
2. Confirm all listed issues are resolved, then submit a review request.
3. Reviews typically take a few days; don't resubmit repeatedly while it's pending.

Step 11: Strengthen Security to Prevent Re-Hacking

Once the site is back online, lock the door behind you:

• Install a firewall extension such as Admin Tools Pro to block common attack patterns.
• Enable Two-Factor Authentication (2FA) for every admin-level user.
• Harden file permissions and restrict access to configuration.php.
• Schedule automatic malware scans on a weekly basis.

🖼️ [ẢNH CẦN CHỤP — BƯỚC 11] Admin Tools Pro (or similar firewall extension) configuration screen with Web Application Firewall enabled.

📹 [VIDEO ĐỀ XUẤT — không bắt buộc] A short (3-5 min) screen-recorded walkthrough of Steps 4–7 (scanning, diffing, database cleanup) would help readers unfamiliar with phpMyAdmin/diff tools, and is worth the production time given this is a high-intent security topic.

❓ Frequently Asked Questions

Can I recover a hacked Joomla site without a backup?

Yes. Compare your live files against a fresh download of the same Joomla version using a diff tool, replace anything altered, then manually clean the database. It's slower than restoring a backup, but fully recoverable.

How long does it take to clean a hacked Joomla site?

A straightforward malware injection can often be cleaned in a few hours. Deeper compromises — backdoors, corrupted database entries, multiple infected extensions — can take a day or more, especially without a clean backup.

Will Google still flag my site as hacked after cleanup?

Yes, until you request a review. Cleaning the site doesn't automatically remove Google's warning — submit a review through Search Console's Security Issues report once everything is fixed.

Do I need to reinstall Joomla completely after a hack?

Not usually. Replacing core files with clean originals and cleaning the database is normally enough. A full reinstall is only necessary if the compromise is too extensive to trace reliably.

How do hackers typically get into a Joomla site?

Most commonly through outdated extensions or templates, weak/reused admin passwords, or unpatched core vulnerabilities — which is why keeping everything updated is the single biggest prevention factor.

Should I hire a professional to clean a hacked Joomla site?

If you're not comfortable editing the database or comparing core files, or if the hack involves financial/customer data, professional incident response is worth it — mistakes during cleanup can destroy evidence or leave backdoors in place.

🧯 Common Mistakes to Avoid

• Restoring an already-infected backup. Always scan a backup before restoring it, even one you think predates the hack.
• Only cleaning visible files. Backdoors often hide in /cache, /tmp, /logs, or unused extension folders.
• Reusing the same admin password after cleanup. If the password was compromised once, treat it as permanently burned.
• Skipping the database cleanup step. File-only cleanup misses injected content in articles, modules, and templates.
• Not checking for new admin users or scheduled tasks the attacker may have created for persistent access.
• Bringing the site back online before requesting a Google review, which delays getting the "hacked site" warning removed.