Hidden Joomla Super Users, and the other accounts to check
An attacker who gets into a Joomla site usually creates a Super User. If it is written straight into the database, sometimes the Users screen doesn't show it, or shows it with an impossible registration date.
The attacker's account survives the cleanup.
Files get cleaned and Joomla updated, but one extra Super User in the database is enough to get back in. If the name looks like a system account, such as "sysadm" or "updater", nobody notices.
Documented campaigns create accounts with recurring names and emails. Recognizing them means knowing those signatures.
What the agent checks.
Hidden accounts
It compares the Super Users in the database with those the Joomla screens list, and checks registration dates.
Attack signatures
It compares usernames and emails with the accounts documented attack campaigns create.
Account hygiene
Super Users without multi-factor authentication, with passwords still in MD5, inactive for a long time, or more of them than usual.
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
Does it work on Joomla 3?
Yes. These checks cover Joomla 3.9 to 6, along with the real-time alert for each new Super User.
How do I enforce MFA for Super Users?
In Users > Options, "Enforce MFA for these groups". Each Super User sets it up in Edit Account > Multi-factor Authentication.
Goes well with
- Instant alerts when a new administrator appearsNew admins, role changes and logins from unknown IPs, as they happen.
- Traces of attacks on JCE, Helix and SP Page Builder on Joomla sitesAltered JCE profiles, code in Helix, SP Page Builder fonts uploaded by nobody.
- Joomla core file integrity checks, even without official checksumsChecksums computed from the official Full Package, for Joomla 3, 4, 5 and 6.
- 169 automatic configuration checks for WordPress, Joomla, Drupal and PrestaShopHidden admins, risky settings, exposed databases and files, with what to do.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.