Detect suspicious PHP file activity before it becomes a bigger problem.<\/strong><\/p>\n Fspirits PHP File Watcher is a lightweight security monitoring plugin<\/a> for Joomla 3 websites running PHP 7.4 or newer<\/strong>. It helps website owners, developers, and administrators detect newly added or modified PHP-like files on their server<\/a> and receive fast email alerts when suspicious file activity appears after a clean baseline has been created.<\/p>\n Many hacked Joomla websites are compromised through hidden PHP shells, backdoors, fake image files, malicious upload scripts, or modified extension files. These files are often placed inside folders such as \u0391\u03c5\u03c4\u03cc \u03c4\u03bf plugin<\/a> is especially useful after a website cleanup, malware removal, Joomla repair, or server<\/a> hardening operation. Once your site is clean, the plugin<\/a> creates a trusted baseline of existing PHP files. After that, it monitors the site and alerts you if new PHP-like files are added or existing PHP files are modified.<\/p>\n The goal of Fspirits PHP File Watcher is simple:<\/p>\n To inform the administrator when PHP-like files are added or changed after the clean baseline.<\/strong><\/p>\n This helps you react faster to possible reinfections, vulnerable extensions, hacked upload forms, compromised admin accounts, or suspicious server<\/a> activity.<\/p>\n \u03a4\u03bf plugin<\/a> checks for newly added executable PHP-style files, including:<\/p>\n These file types are commonly used by attackers when they upload web shells or backdoors.<\/p>\n Fspirits PHP File Watcher can also alert you when existing PHP files are changed after the baseline.<\/p>\n This is useful for detecting:<\/p>\n After installation, the plugin<\/a> creates a baseline of the existing PHP files on your Joomla website.<\/p>\n The baseline acts as the \u201cknown clean state\u201d of your site. Any future difference can be reported to the administrator.<\/p>\n \u0391\u03c5\u03c4\u03cc \u03ba\u03b1\u03b8\u03b9\u03c3\u03c4\u03ac \u03c4\u03bf plugin<\/a> ideal to use after cleanup<\/strong>, when you want to know if anything suspicious appears again.<\/p>\n When suspicious PHP file activity is detected, the plugin<\/a> sends an email alert to the administrator.<\/p>\n The alert can include:<\/p>\n This gives you fast visibility without needing to manually check the server<\/a> every day.<\/p>\n \u03a4\u03bf plugin<\/a> includes improved logic for large Joomla sites and e-shops.<\/p>\n For large sites, you can run the scanner by cron only and schedule it to check:<\/p>\n This avoids slowing down normal visitors and helps prevent timeout issues on large sites.<\/p>\n For big Joomla websites, the safest mode is Cron Only<\/strong>.<\/p>\n This means the plugin<\/a> does not scan during normal website visits. Instead, your server<\/a> runs the scan in the background using a cron job.<\/p>\n This is ideal for high-traffic websites, large Joomla installations, VirtueMart shops, and websites with thousands of files.<\/p>\n When available, the plugin<\/a> can use the server<\/a>\u2019s native Linux This is usually much faster than a pure PHP recursive scan, especially on large websites with many folders and files.<\/p>\n If shell execution is not available, the plugin<\/a> can fall back to PHP scanning.<\/p>\n \u03a4\u03bf plugin<\/a> excludes common Joomla cache folders by default, including:<\/p>\n This helps reduce noise and avoids unnecessary scans of temporary files.<\/p>\n \u03a4\u03bf plugin<\/a> includes protection against incomplete scan problems.<\/p>\n If the configured scan limit is reached before the full scan is completed, the plugin<\/a> does not incorrectly mark unseen files as missing. This prevents thousands of false alerts such as \u201cfile returned after previously being missing.\u201d<\/p>\n \u0391\u03c5\u03c4\u03cc \u03ba\u03b1\u03b8\u03b9\u03c3\u03c4\u03ac \u03c4\u03bf plugin<\/a> safer for very large Joomla sites.<\/p>\n A hacked Joomla website is not always obvious immediately. Many attackers upload a small PHP file and leave it hidden for later access.<\/p>\n Common attack locations include:<\/p>\n A malicious PHP file inside a writable folder can be enough to reinfect the site, send spam, inject code, or give the attacker remote access.<\/p>\n Fspirits PHP File Watcher helps you notice this type of activity faster.<\/p>\n \u0391\u03c5\u03c4\u03cc \u03c4\u03bf plugin<\/a> is perfect for:<\/p>\n Install the plugin<\/a> after cleaning a hacked Joomla site. Create a new baseline and monitor for reinfection.<\/p>\n Use the plugin<\/a> after replacing suspicious or modified Joomla files with clean versions.<\/p>\n Combine it with proper file permissions and server<\/a>-level protection to detect suspicious activity.<\/p>\n Monitor changes after installing or updating Joomla extensions.<\/p>\n Run it once or twice per day using cron and receive alerts when suspicious PHP file activity appears.<\/p>\n For big sites, we recommend:<\/p>\n This setup gives good protection while avoiding unnecessary server<\/a> load.<\/p>\n For a Joomla site installed in:<\/p>\n You can run the plugin<\/a> with:<\/p>\n Example cron running every 15 minutes, while the plugin<\/a> itself decides whether it is time to scan:<\/p>\n \u03a4\u03bf plugin<\/a> can be configured to actually scan only once or twice per day.<\/p>\n Fspirits PHP File Watcher is a security monitoring and alert plugin<\/a><\/strong>. It does not replace a firewall, malware scanner, backup system, or professional cleanup service.<\/p>\n Its purpose is to help you detect suspicious PHP file activity quickly, so you can investigate and respond before the problem becomes worse.<\/p>\n For best results, use it together with:<\/p>\n Fspirits PHP File Watcher is a practical Joomla security plugin<\/a> that helps you monitor your website for suspicious PHP file changes.<\/p>\n It is simple, focused, and useful for real-world Joomla protection. After creating a trusted baseline, it watches for new or modified PHP-like files and alerts the administrator when something changes.<\/p>\n For Joomla 3 websites, especially older or previously infected installations, this plugin<\/a> can become an important early-warning system against reinfections, hidden shells, and unwanted PHP file activity.<\/p>","protected":false},"excerpt":{"rendered":"images<\/code>, media<\/code>, tmp<\/code>, components<\/code>, plugins<\/a><\/code>, modules<\/code>, or template directories. Fspirits PHP File Watcher gives you an extra layer of visibility by watching your Joomla installation for unexpected PHP file changes.<\/p>\nMain Purpose<\/h2>\n
\u0392\u03b1\u03c3\u03b9\u03ba\u03ac \u03c7\u03b1\u03c1\u03b1\u03ba\u03c4\u03b7\u03c1\u03b9\u03c3\u03c4\u03b9\u03ba\u03ac<\/h2>\n
Detects New PHP-Like Files<\/h3>\n
.php\r\n.phtml\r\n.php3\r\n.php4\r\n.php5\r\n.phar\r\n<\/code><\/pre>\nDetects Modified PHP Files<\/h3>\n
\n
Clean Baseline System<\/h3>\n
Email Security Alerts<\/h3>\n
\n
Large Website Friendly<\/h3>\n
\n
Cron-Only Mode<\/h3>\n
Optimized Linux Find Scanner<\/h3>\n
find<\/code> command for faster scanning.<\/p>\nDefault Cache Exclusions<\/h3>\n
cache\r\nadministrator\/cache\r\nadministrator\/cache\/plg_system_phpfilewatcher\r\nlogs\r\n<\/code><\/pre>\nFalse Alert Protection<\/h3>\n
\u0393\u03b9\u03b1\u03c4\u03af \u03b1\u03c5\u03c4\u03cc Plugin<\/a> Is Useful<\/h2>\n
\/images\r\n\/media\r\n\/tmp\r\n\/cache\r\n\/templates\r\n\/plugins<\/a>\r\n\/modules\r\n\/components\r\n\/administrator\/components\r\n<\/code><\/pre>\nIdeal For<\/h2>\n
\n
Recommended Use Cases<\/h2>\n
After Malware Cleanup<\/h3>\n
After Restoring Joomla Core Files<\/h3>\n
After Hardening File Permissions<\/h3>\n
Before and After Extension Updates<\/h3>\n
Long-Term Security Monitoring<\/h3>\n
Recommended Settings for Large Joomla Sites<\/h2>\n
Run trigger: Cron only\r\nSchedule mode: Once per day or Twice per day\r\nScanner engine: Auto\r\nUse SHA1 hash: No\r\nAlert on new files: Yes\r\nAlert on modified files: Yes\r\nAlert on deleted files: No\r\nAlert when missing file returns: No\r\nMax files per scan: 0\r\nMax scan seconds: 120\r\nMax alerts per email: 50\r\n<\/code><\/pre>\nExample Cron Job<\/h2>\n
\/home\/example\/public_html\r\n<\/code><\/pre>\n\/usr\/bin\/php \/home\/example\/public_html\/plugins<\/a>\/system\/phpfilewatcher\/cron.php\r\n<\/code><\/pre>\n*\/15 * * * * \/usr\/bin\/php \/home\/example\/public_html\/plugins<\/a>\/system\/phpfilewatcher\/cron.php >\/dev\/null 2>&1\r\n<\/code><\/pre>\nRequirements<\/h2>\n
Joomla: 3.x\r\nPHP: 7.4 or newer\r\nDatabase: Joomla-supported MySQL\/MariaDB\r\nRecommended: Linux \u03c6\u03b9\u03bb\u03bf\u03be\u03b5\u03bd\u03af\u03b1<\/a> environment\r\nRecommended for large sites: Cron access\r\n<\/code><\/pre>\nImportant Note<\/h2>\n
\n
\u03a0\u03b5\u03c1\u03af\u03bb\u03b7\u03c8\u03b7<\/h2>\n