Support

I believe that nobody "broke into" your site. The User-Agent points to someone using an up-to-date Firefox installation on Windows 10 or 11, and the IP address is a VPN server geographically close to you. It looks like it was you. Besides, no attacker would just log into as a Super User using their PC and just do nothing, not even attempt to change the Admin Tools configuration or modify your site's files. It would be like a burglar using a set of keys to get into your house, leave a sticky note "I was here", and leave. It makes no sense.

Regarding modified files, please remember that the files are reported not only if their contents change, but also if their last modified time changes. This could happen when updating Joomla, for example.

If you want to be extra sure that nobody will get into your site you can of course use the administrator password protection feature in Admin Tools, as well as the Administrator Secret URL Parameter. Moreover, you should enable multi-factor authentication on your user account. It used to be a product of mine, Akeeba LoginGuard, which I contributed to Joomla itself a few years ago.

I mean, at this point I would restore the site from a previous backup and enable the security measures I told you about. For WordPress, since it does not have MFA built into it, you can use a third party plugin such as Two-Factor.

As a precaution, I would also change the passwords for the CMS (Joomla, WordPress) user account, and the hosting user account. I would definitely be using a password manager which can generate secure, random passwords consisting of at least 32 alphanumeric characters.

Remember: if someone somehow has your username and password they cannot be stopped by a security extension/plugin. From the site's point of view their accessing the site is indistinguishable from an authorised user (you) accessing the site; the username and password are the proof. Adding MFA/2FA is the only way to prevent access as the nature of MFA/2FA means the unauthorised user won't be able to guess them or brute force them.