Clean Hacked Website Files

By comparing infected files with known good files (from official sources or reliably clean backups) you can identify and remove malicious changes.


It is important that you compare the same version of your Joomla! core files and extensions. Core files on the 2.x branch are not the same as the 3.x branch and so on.

Never perform any actions without a backup. If you’re unsure, please seek assistance from a professional.

To manually remove a malware infection from your Joomla! files:

  1. Log into your server via SFTP or SSH.

  2. Create a backup of the site files before making changes.

  3. Search your files for reference to malicious domains or payloads you noted.

  4. Identify recently changed files and confirm whether they are legitimate.

  5. Review files flagged by the diff command during the core file integrity check.

  6. Restore or compare suspicious files with clean backups or official sources.

  7. Remove any suspicious or unfamiliar code from your custom files.

  8. Test to verify the site is still operational after changes.

If you can't find the malicious content, try searching the web for malicious content, payloads, and domain names that you found in the first step. Chances are that someone else has already figured out how those domain names are involved in the hack you are attempting to clean.

Diff tools to compare suspicious files with known-good copies: