Take the 2-minute tour ×
Joomla Stack Exchange is a question and answer site for Joomla! administrators, users, developers and designers. It's 100% free, no registration required.

Can be administrator directory effectively renamed (for example by simple change in Joomla! core code) for example to admTZ34? The main reason is to obfuscate standard pattern where www.example.com/administrator could be used to check presence of Joomla! installation (in older releases also Joomla! version etc.)

share|improve this question
    
Before Joomla SE was set up I asked this same question here on SO: stackoverflow.com/questions/15034980/… –  tim.baker May 5 at 12:58

3 Answers 3

up vote 10 down vote accepted

It's not really recommended or very simple. The admin path gets hardcoded in a lot of extensions with calls to things like JTables which means changing the directory name could have a lot of consequences.

That said if you want to prevent direct access there's two ways of going about it:

1) Password protect /administrator with a .htaccess password protection. This uses HTTP authentication to prevent anyone from getting to the admin directory.

2) Require a keyword in the URL with a tool like JSecure or Akeeba Admin Tools. The admin url will be: site.com/administrator?mySpecialPhrase

Admin tools (http://www.akeebabackup.com) is capable of doing both options for you, or you can do option 1 with just an .htaccess file (http://httpd.apache.org/docs/current/programs/htpasswd.html).

share|improve this answer
    
Quick question regarding your first point. Will protecting it using a .htaccess file prevent files being moved the necessary directories within the administrator folder upon installation of extensions? –  Lodder May 4 at 23:59
2  
I don't believe so because .htpasswd will only check for http access. When copying files around via the installer I think all that happens at the server level so I don't think this will matter. That said, I have seen issues with things like javascript being stored in /administrator and being called via HTTP on the front end and asking users to login. So this isn't always a workable solution. –  Chad Windnagle May 5 at 0:07
    
@ChadWindnagle +1 from my side in your answer and your comments. Backend Protection through htaccess is a good solution but few extension fetch site's images and javascript from site's backend, In-that case htaccess restrict to access these images and javascripts. –  Manish Trivedi May 5 at 5:09
    
Continue @ChadWindnagle answer 3) Use two factor authentication extensions.joomla.org/extensions/access-a-security/… –  Manish Trivedi May 5 at 5:10
    
Nice suggestion on 2 factor. That said I think it's in Joomla 3.2+ so an extension shouldn't be necessary if running latest version of Joomla. –  Chad Windnagle May 5 at 14:10

You can't really change it as it would prevent extensions from installing properly. You can however use Admin Exile which allows you to add a value, key or both to the administrator URL. In addition to this, if the standard admin URL is typed it, it will redirect the user to a site of your choice.

http://extensions.joomla.org/extensions/access-a-security/site-security/login-protection/15711

Hope this helps

share|improve this answer
    
So if I understand, the main problem is plugins, right? Can it be said that Joomla! installation without extensions can withstand renaming of administrator directory relatively safely? –  miroxlav May 5 at 0:06
1  
Extensions in general, not just plugins. There are also other reasons why you should not change the name of the folder. One reason @Chad explains regarding JTables –  Lodder May 5 at 0:07
    
In addition to that, the whole thought process of renaming /administrator/ in general as a practice is not a good one. It's not "real" security. The author of Akeeba backup and a Joomla security expert wrote about a similar type of move regarding configuration.php [dionysopoulos.me/keep-your-files-where-i-can-see-them/] I'd recommend reading that to understand why this type of change is frowned upon. –  Chad Windnagle May 5 at 0:11

If your only concern is bad-bots identifying your website as joomla website then you need to do a lot more to hide this truth.

A lot of technique exist to identify your website as joomla and its version. This .htaccess file helps in these attacks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.