Joomla Stack Exchange is a question and answer site for Joomla! administrators, users, developers and designers. It only takes a minute to sign up.
Sign up to join this community
My website has been blocked by google because it thinks it's been affected by malware. When I run scans they don't show anything. How can I detect what's wrong?
My sites always get affected with malware and the site is then blocked by google. I cannot figure out what causes it . is it the hosting or Joomla itself or incorrect security settings. can someone please help how to protect from these javascript and PHP code injections?
DON'T TRUST SITE OR MALWARE SCANNERS!
You should use a firewall extension like Admin Tools to secure your cms. Unfortunately it's a bad practice to try to get your infected site back online, yeah because it's compromised and could have some backdoors now.
The best and secure way would be setting up a new Joomla site and transferring your content by hand from your old site.
But, what I do in such situations:
Make a list of installed third-party extensions (plugins, modules, components). Deactivate ALL OF THEM.
Duplicate the current database to a new one. (Databases should always have limited local access, no remote access! Don't use the old database password!)
Setup a new Joomla installation, after the installation change the database to the duplicated one. This can lead to some errors if your database is from a different Joomla version. Reinstall the last Joomla update via com_joomlaupdate (?option=com_joomlaupdate), if necessary do a database repair run through the com_installer (?option=com_installer&view=database) .
Reinstall your third-party extensions (latest version) and activate them one by one.
If possible, install a fresh and updated version of your frontend template. If it's custom or modified and you are familiar with PHP / JS and malware code, you can download your old template via FTP and check every file (php,js,css etc.) for malware code, remove it. Zip your template and install your template to the new site.
Install and setup Admin Tools firewall.
Check every third-party extension if they are really needed, if not, uninstall them. Mostly your form extensions or extensions with ajax calls are the weak point.
If possible, get a SSL-certificate (Let's Encrypt e.g.) and force SSL (Joomla config, htaccess) on your whole site.
Don't forget to change all user account passwords, your ftp passwords and email passwords.
Delete all the data (ftp + database) from the old site and check if there are more folders and files in the webspace root, those could be also compromised and should be deleted or at least set chmod to 000 to lock access to those files and folders. (not your new installation of course)
Now you can start to unlist your domain from blacklists. Btw., always keep an eye on the folder and file permissions, NEVER use chmod 777!! (Admin Tools will handle this for you.)
Folders: 755 or "lower" Files: 644 or "lower"
Do backups every week or month. (Akeeba Backup is good for me.)
Joomla Security and overall security is a very broad topic. Your question is also the same. So any answers will turn around the essentials of a Secure Joomla website and what to do if it's hacked/affected with malware, which is widely covered on Q/A on JSE and in many other locations on the web, plus you already have a good answer by Dennis Heiden here with some additional links to Joomla security resources.
So the level of help you are seeking here it's certainly covered somewhere and I doubt there can be any more insightful answer here that's not referred elsewhere.
If you are unable to resolve it, then I recommend to hire an expert to work on your security issues, clean up your site and secure it.
I also started considering that lack of information in your question and thought that you never mentioned your Joomla version. Then I saw your comment that your have J 3.4.5. That explains why your site is getting hacked, but also denotes that you haven't study/research enough as you claimed you have done in your comments.
Keeping a Joomla Installation up-to-date is the #1 security rule. We can't expand on anything else of the causes and whys for a Joomla site being hacked, if the site itself is not up to date and uses a vulnerable and insecure version of Joomla!.
UPDATE TO THE LATEST JOOMLA ASAP!!!
Same time, I still recommend to hire an expert anyways.
