How to Replace Joomla Core Files After a Compromise
Do not trust compromised executable files
Once a site is confirmed compromised, avoid trying to identify and hand-edit every changed Joomla core file. Joomla's security guidance recommends replacing files with clean copies because attackers may leave hidden backdoors. Preserve evidence and a forensic copy before destructive cleanup if the incident needs investigation.
Use an official Joomla package for the correct release
Obtain Joomla from an official Joomla source and make sure the clean package matches the version or supported recovery path you intend to run. Do not mix arbitrary core files from different Joomla releases. A major-version package is not a drop-in repair for an older installation and can create a second failure unrelated to the compromise.
Preserve site-specific data separately
Before replacing files, securely preserve configuration.php and known-good user content that cannot be recreated, such as verified media. Treat every preserved file as potentially contaminated and inspect it before returning it to service. Do not copy the entire compromised tree into the clean installation, because that can copy the attacker's persistence with it.
Replace rather than merge questionable core code
Build from a clean Joomla package or replace the compromised Joomla core tree according to your tested recovery procedure. Avoid uploading clean files over the top and assuming extra malicious files will disappear; overwrite operations do not necessarily remove files that are absent from the clean package.
Reinstall extensions and templates from trusted packages
Joomla's compromised-site checklist recommends clean copies of templates and extensions as well as core files. Obtain current compatible packages directly from trusted vendors and reinstall them instead of preserving executable PHP from the compromised installation. Remove extensions that are abandoned, vulnerable, or no longer required.
Check permissions and ownership after replacement
Verify that files and directories have appropriate ownership and permissions for the hosting environment. Joomla's security material warns against insecure world-writable permissions such as 777. Use the host's recommended secure values rather than blindly applying one permission scheme to every server.
Update, test, and scan before reopening
After clean files are in place, apply supported Joomla and extension security updates, rotate credentials, inspect the database and user accounts, and test the frontend and Administrator. Review server and application logs for continued suspicious activity before restoring public access. Reappearance of altered files indicates an unresolved access path.
Need More Help with Joomla?
Still having trouble? Open a support ticket with QuantaCade Support and we'll be happy to help where we can.
Support priority is given to QuantaCade products, services, and customers. However, we're also happy to assist fellow Joomla users with general Joomla questions and troubleshooting when possible.
QuantaCade is an independent Joomla extension developer and is not official Joomla support. Some issues involving third-party extensions, hosting environments, server configurations, or other systems outside our development control may be beyond what we're able to resolve.