Joomla site hacked - the first steps, in the right order

Calm, and in a sensible order. This guide works without a command line - and it says where on-board tools stop being enough.

What Joomla’s offline switch does - and what it does not

Joomla has a switch that closes the site to visitors. You reach it via Home Dashboard›Global Configuration, tab Site, setting Site Offline. Two limits matter. The Joomla manual states plainly that the switch does not apply to the administrator interface and users who can log in to the back end. And Google means something stricter by taking a site offline: it should stop serving content to users at all. Google adds that returning a 4xx or 5xx status code is not enough to protect your users, because harmful content can still be delivered alongside it.

Secure the traces before you clean

Joomla keeps its own record of back-end activity under Users›User Actions Log. Only Super Users can open it, and it can be downloaded as a CSV file straight from the back end. Read it knowing its limits: IP addresses are not recorded unless that option is switched on, only events from the extensions selected in its options are logged at all, and old entries are deleted after a number of days set in the accompanying plugin. What is not in there is not proof that nothing happened.

Check for accounts that are not yours

Open Users›Manage. The list shows, among others, Username, User Groups, Last visit and Registered for every account. Look for accounts you did not create, especially ones in a group with far-reaching rights, and for accounts that registered around the time the trouble started.

1. Change passwords and require multi-factor login

   Change the passwords of all back-end accounts. Joomla ships multi-factor authentication and can make it mandatory for a user group - the official manual recommends switching it on.

2. Remove foreign accounts

   Delete accounts you did not create. Deleting alone is not enough if the way in is still open.

3. Update Joomla and every extension

   Update the core via System›Update›Joomla and the extensions via System›Update›Extensions. Note the limit Joomla itself names: only extensions that support the update server appear there. Everything else has to be updated by hand.

4. Check the Vulnerable Extensions List

   Compare what you have installed against the official list. It also has a category for flaws with no fix available - an extension listed there has to go, not just be hidden.

5. Do not just hide a vulnerable extension

   The Joomla documentation is explicit: removing menu links or unpublishing a module does not make the extension unreachable.

A backup alone rarely settles it

Restoring yesterday’s backup feels like the clean solution, and sometimes it is. Often it is not. Sucuri puts its own clean-up experience like this: “Hackers always leave a way to get back into your site. More often than not, we find multiple backdoors of various types in hacked Joomla! sites.” A backup from before the break-in still contains the vulnerability that let them in - and a backup from after it may already contain the back door.

When to hand it to someone else

There is a point where on-board tools stop. Sucuri names it in its own guide: some steps need web server and database access, and if you are not comfortable working with database tables or server files, you should ask for help rather than experiment. That is not a failure - a half-cleaned site that gets re-infected costs more than doing it properly once.

Sources & further reading

• Joomla manual - Site Offlinethe switch and its limits
• Google - Quarantine your sitewhat taking a site offline means
• Joomla manual - User Actions Logaccess, CSV export, retention
• Sucuri - How to Fix, Clean & Secure a Hacked Joomla! Siteback doors and the limits of on-board tools
• Joomla - Vulnerable Extensions Listofficial list, including flaws without a fix

Wiążące są zawsze oficjalne informacje danego producenta. Ta strona w neutralny sposób podsumowuje ogólnodostępne informacje.