Critical Files Monitoring

The Critical Files Monitoring tab (available since version 5.2.0) watches the files most commonly targeted by attackers and reacts as soon as any of them changes, without waiting for the next scheduled File Integrity scan.

What is monitored

  • configuration.php
  • The front-end index.php and the back-end administrator/index.php
  • The index.php, error.php and component.php files of every installed template (site and administrator)
  • Any additional files you configure

How it works

The check runs after the response has been sent to the visitor, so it adds no perceptible latency, and never more often than the configured check interval regardless of traffic. Each check only reads the size and modification date of the monitored files; a hash is computed only when they differ, so the cost is negligible. If a file is rewritten with identical content (for example by a deployment), the baseline is updated silently and no alert is raised.

When a real change is detected, SecurityCheck Pro:

  1. Records a Critical file modified entry in the firewall logs listing the affected files.
  2. Sends an email to the addresses configured in the firewall email settings (at most one email every 30 minutes; changes in between are still logged).
  3. Optionally schedules a File Integrity scan by bringing forward the next execution of the SecurityCheck Pro scheduled task.

The automatic scan requires an enabled SecurityCheck Pro scheduled task in the Joomla Task Scheduler. The scan is never executed inside the request that detects the change: the Task Scheduler runs it through its normal trigger (CLI cron, web cron or lazy scheduler).

Avoiding repeated scans

Two settings prevent the monitor from consuming resources when files change frequently — for example while you are working on your template:

  • Quiet period: the scan is only launched after the configured number of minutes without further changes. Twenty consecutive edits result in a single scan when you finish.
  • Scan cooldown: after an integrity scan, the monitor will not request another one until the cooldown expires. Changes during the cooldown are still logged and emailed.

Options

Option Default Description
Monitor critical files No Enables the feature. The first check after enabling only records the baseline; no alert is raised.
Check interval (seconds) 120 Minimum time between checks, regardless of traffic. Range: 30–3600.
Additional files (empty) Extra files to monitor, relative to the site root (e.g. administrator/includes/app.php), one per line or separated by commas.
Send email on change Yes Sends an alert email using the firewall email settings when a critical file changes.
Launch File Integrity scan Yes Brings forward the SecurityCheck Pro scheduled task so a File Integrity scan runs automatically after a change.
Quiet period (minutes) 15 Minutes without further changes before the scan is launched. Range: 1–1440.
Scan cooldown (hours) 6 Hours after an integrity scan during which the monitor will not request another one. Set to 0 to disable the cooldown.

A legitimate update of Joomla or of a template will also modify these files and trigger an alert (and possibly a scan). This is expected: the alert tells you the change happened, and the integrity scan gives you the complete picture.

Global Configuration Critical Files Monitoring tab with check interval and alert settings