Welcome to this lesson on the PHP File Scanner.
The PHP File Scanner is one of the more advanced features of Admin Tools.
It monitors the PHP files that make up your Joomla website, recording their contents so it can detect when files have been added or modified.
It also examines those files for patterns that might indicate malicious code.
To begin, we'll perform our first scan.
Depending on the size of your website, this may take a few minutes, so simply allow it to complete.
When the scan finishes, you'll see a summary showing the date and time of the scan, the number of PHP files that were scanned, how many files have changed since the previous scan, how many new files have been detected, and how many files have been flagged as possible threats.
Notice the wording: possible threats.
That's an important distinction.
The scanner isn't able to decide whether a file is safe or malicious.
Instead, it looks for patterns that are commonly found in malicious code and flags anything that deserves closer inspection.
That means some perfectly legitimate files may be reported as suspicious, while genuinely malicious code may not always be detected.
Think of this as an early warning system rather than a replacement for careful investigation.
Click View Report to see the detailed results.
Each file is listed together with an estimated threat score.
Because I've just installed Joomla and my extensions from trusted sources, I know these files are legitimate.
Any warnings shown here are therefore false positives.
I'll select those files and click Mark Safe.
Remember that the report may span several pages, so you'll need to repeat this until you've reviewed all of the results.
Now let's run the scanner again.
This time nothing has changed.
No files have been modified, no new files have appeared, and there are no outstanding possible threats.
Because there are no changes to report, no new report is generated.
Once you've established this initial baseline, the scanner becomes much more useful.
If a file changes unexpectedly, or a new PHP file suddenly appears, Admin Tools will immediately highlight it for your attention.
I recommend running the scanner regularly.
It's especially useful immediately before and after installing or updating Joomla or an extension.
That way you know exactly which file changes were expected and can quickly mark any legitimate changes as safe.
If you'd prefer not to run scans manually, Admin Tools also includes a PHP File Change Scanner Scheduler.
This allows scans to run automatically and email the results to you.
The page includes everything you need to configure the scheduler, together with links to the documentation if you need more detailed instructions.
Finally, remember what this tool is designed to do.
It helps you identify unexpected file changes and highlights files that deserve investigation.
It is not an antivirus product, and it cannot guarantee that every threat will be detected or that every warning represents malicious code.
Used alongside regular updates, good backups and sensible security practices, however, it can be a very valuable part of protecting your Joomla website.