Issue Joomla website hacked

[LaurentR2D2]

Server operating system version

Debian 12.15

Plesk version and microupdate number

Plesk Obsidian v18.0.80_build1800260918.14 os_Debian 12.0

Plesk Obsidian v18.0.80_build1800260918.14 os_Debian 12.0
Debian 12.15
PHP 8.4.25
Joomla! 6.1.3 Stable [ Nyota ] 18-August-2026 16:00 UTC

Hello,

This is the second time my Joomla site has been hacked, and I’ve had to reinstall it. It’s the same thing every time. I end up with additional WordPress wp-* files. The index.php and configuration.php files are modified, and I can no longer access the site or the admin panel. The homepage displays a blank page, and the admin panel shows a message like “WordPress Briefly unavailable for scheduled maintenance. Check back in a few hours.” The permissions for the httpdocs folder have also been changed from 750 to 555. The first time, I've changed the FTP password as well as the SSH passwords for my server and reinstalled Joomla from my Akeeba backup. It wasn’t even a week before it happened again.

I don't know where to look to fix the security problem of my server. I have other websites hosted on my server, and none of them have a problem (wordpress, simplemachine forum, basic html website).

Thank you

 

[scsa20]

To be honest restoring from backups isn't going to be enough to keep them out if they were in for awhile and you will need to know how they're getting in. Review access logs and such. Check in phpMyAdmin for any admin accounts in #__users table, etc.

You'll also want to make sure you change the passwords to any additional FTP users, SSH keys, database user password, every joomla admin, SMTP/API keys, and the $secret inside the configuration.php.

Also, check what extensions, themes, etc., you have installed. Even though you have the latest version of Joomla installed doesn't help if there's an extension or theme that's outdated and open for attacks.

Ideally you would just want to do a complete clean install of Joomla and only restore the content (images/media) and maybe the database if you know that the database is clean.