In short
On Joomla, intrusions usually come in through an outdated extension or an unsupported version: Joomla 3 stopped getting patches in August 2023 and Joomla 4 in October 2025. At WebIntacta (Jose Soriano) I review your Joomla from the inside with a read-only plugin, without asking for FTP: core integrity, PHP hidden in images, forgotten backups and extensions with their versions. The external scan is free and the report costs €129, excluding VAT.
Reviewed by Jose Soriano ·
Plenty of business websites still run on Joomla, and plenty of them on a version that no longer gets patches. I review your Joomla from the inside, with a read-only plugin you install from the administrator, and tell you what is wrong, what is urgent and what upgrading involves.
Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.
STEP 01
Joomla version and whether it is supported, published core vulnerabilities, exposed files, HTTPS, headers, email and blacklists.
STEP 02
Installed from System → Install → Extensions, no FTP needed. It only answers requests signed from my panel and you can disable it whenever you like.
STEP 03
A PDF with the grade, the urgent items first and a concrete action for each finding: update, replace the extension or clean up.
What I look at first on a Joomla site, and what you can check yourself from the administrator or your hosting's file manager:
templates/<your-template>/html/ survives updates: it is a good place to hide code, and you need to know where every file there comes from.installation/ folder, no configuration.php.bak, and no Akeeba Backup archives inside the public site with kickstart.php next to them.configuration.php protected, with read-only permissions, because it stores the database password.In February 2023 a flaw was published in Joomla 4.0.0 to 4.2.7 (CVE-2023-23752) that let anyone read the site's configuration through its API without logging in, database password included. It was fixed in 4.2.8, but for months it was exploited at scale against sites that had not updated. It is the usual pattern: the patch exists, the website does not have it.
The signs are the same as on any CMS: redirects, Google warnings, indexed spam pages or Super Users nobody created. Start with how to tell if your website is hacked and do not delete anything before making a backup. Cleaning a hacked Joomla costs from €390, with a fixed quote after the scan, because it depends on the extensions and the version; the process is the same as in hacked website repair: backup, cleanup, closing the way in and the Google review.
I do not have a fixed-price maintenance plan for Joomla: each installation depends heavily on its extensions and on whether it needs a version migration. If you need one, I send you a quote with what it includes and what it costs per month, after the report.
The report is fully deducted if you order the cleanup within 30 days. The cleanup price is agreed in writing before I start.
Security grade and the problems visible from the internet, in a few minutes and with no sign-up.
Free
No sign-up, no commitment
An inside analysis with the read-only connector and a PDF with an action plan.
€129
excluding VAT$129 outside the EU
Joomla, Drupal, Magento or your own code: a fixed quote after the analysis.
from€390
excluding VATfrom $390 outside the EU
For Joomla sites outside the EU, the report is $129 and the cleanup from $390. All prices
Joomla 3.10, 4, 5 and 6. If you cannot install extensions (for example, without administrator access), I use a temporary agent uploaded by FTP that expires after 72 hours and deletes itself.
Yes: it is the riskiest case, because the core no longer gets patches. The report tells you what needs protecting now and what migrating to a supported version involves, which is a project and not a simple update.
No. It sends versions, file fingerprints and metadata, plus the contents of the files I ask for so I can review them; never the configuration with passwords, nor backups or dumps. It changes nothing and only answers requests signed from my panel.
It costs from €390, excluding VAT, with the price agreed in writing after the scan and before I start.
Free external scan. No sign-up and nothing to install.
Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.