The original PHP File Change Scanner had no way to distinguish between Joomla core files and files belonging to third-party extensions. Every PHP file on the site had to be scanned, hashed, and compared against the previous run, resulting in two common problems:
False positives after Joomla updates. Legitimate Joomla updates modify hundreds of core files. Every one of those files would show up as "modified" in the next scan, flooding the report with noise and making it hard to spot genuinely suspicious changes.
Slow first scans. On a fresh Joomla installation, the very first scan writes a database record for each of the thousands of core PHP files. This produced lengthy first runs dominated entirely by database writes for files that had never been — and would never be — suspicious.
CoreSums solves both problems. Intact core files are skipped entirely, eliminating the false-positive noise from routine Joomla updates and cutting the time and database load of first scans substantially. At the same time, any core file whose hash does not match the published checksum is immediately highlighted as potentially tampered, making real threats far easier to find.