Core file — intact. The file exists in the checksums list and its hash matches. The file is recognised as a pristine, unmodified Joomla core file and is skipped entirely. This is the main reason first-time scans become dramatically faster: the vast majority of PHP files on a typical Joomla site belong to Joomla itself and no longer need to be written to the database as new entries.

Core file — tampered. The file exists in the checksums list but its hash does not match. This almost certainly means the file has been altered since Joomla was installed — either by a legitimate Joomla update that has not yet been reflected in the checksums service, by a server-side patch applied by a hosting provider, or, most worryingly, by a malicious actor. These files are pushed to the top of the scan report and receive a large additional boost to their threat score so they are impossible to miss.

Non-core file in a core folder. The file does not appear in the checksums list at all, yet it lives inside a directory that belongs to a Joomla core extension, template, or library (for example, inside libraries/joomla/ or administrator/components/com_content/). Third-party extension directories — such as components/com_myextension/ — are never considered core folders. How Admin Tools handles non-core files in core folders is configurable: they can be silently ignored, flagged in the report with a neutral badge, or flagged and scored as a potential threat. See the Non-core files in core folders option in the component Options page.

Out of scope. The file lives outside any core folder and is not listed in the checksums file. It is treated exactly as before: compared against the previous scan result, assigned a threat score if it is new or modified, and reported accordingly.