How to secure a new Joomla installation?

Question

What are the actions that one should take after a new Joomla installation in order to keep it secure? Both on shared hosting servers and dedicated ones.

Answer 1

Keeping a Joomla Website Secure

1. Use strong passwords.
2. Minimise the number of administrator accounts.
3. Disable or remove unused user accounts.
4. Minimise the number of third party extensions and where third party extensions are necessary, use well supported extensions from established developers you trust.
5. Regularly apply the latest updates to Joomla and third party extensions including security hotfixes for Joomla EOL versions where applicable.
6. Subscribe to the Joomla Security News feed so you are kept informed of core Joomla security updates
7. Subscribe to the Joomla Vulnerable Extensions List (VEL) so new vulnerabilities can be quickly attended to. Scroll to the bottom of the page for the subscription link - you can also follow the VEL on Twitter.
8. Use good quality secure web hosting including an appropriate PHP file handler such as suPHP or FastCGI and security extensions such as mod_security. Use a supported version of PHP.
9. Rather than relying solely on your web hosting company backups, regularly perform your own backups of the website, copy the backup files off-site and regularly run test restores to a test location to check the quality of your backups.
10. Enable https.
11. Implement a web application firewall such as that provided with the professional version of Akeeba Admin Tools.
12. Don't use the standard table prefix.
13. Change the default Super Administrator user name and ID to something else. The professional version of Akeeba Admin Tools has a tool to change the Super Administrator ID.
14. Restrict access to the Joomla Admin by IP. Only allow trusted IPs.
15. Enable 2 factor authentication for administrator accounts (applies to Joomla 3.2 and later).
16. Repeat the above steps for other websites that share the same hosting account or ideally, separate websites to their own web hosting accounts to prevent cross contamination.
17. Ensure the personal computers of website administrators are similarly secured. For example, implement a good quality virus and malware scanner. This helps protect any website credentials that are stored on personal computers. Ideally use an encryption tool or application to store website and other credentials.
18. Read the Top 10 stupidest administrator tricks for information on what not to do.

For more detailed instructions, see the official Security Checklist.

Answer 2

It's very important to store backups on a separate server. I see a lot of people who are faithfully running Akeeba Backups... and they're being stored on the same server in the same root directory. Not so helpful if you are hacked in a serious way, and certainly not helpful to recover from a hosting failure.

Akeeba Backup Pro allows you to store and manage backup files in external storage like the Amazon cloud.

Answer 3

As an alternative to .htaccess file or locking it down by IP, you can also use jSecure to secure your admin login.

One thing that hasn't been mentioned is using a reputable hosting provider. You want one that not only keeps up with security but will also work with you if you are hacked or there is a problem (database gets corrupted for example). The idea is to limit the damage your site does while allowing you to get it cleaned up.

The basic idea, you want someone who..

• will be around
• isn't a fly-by-night operation
• will work with you
• and provides a solid environment.

If you want a list of questions to ask a host to get a better feeling, just let me know.

Hope this helps.

Answer 4

Try this too,

• Keep your Joomla up-to-date together with its extensions.
• Keep regularly backups of your site in clouds.
• Do not open robots.txt for secured folders.
• For the latest Joomla versions, making use of the two-factor authentication will be more secure.
• Make sure folders and files have the right permissions allowed.
• Use Cloudfare for Joomla.

Hope its helps..

Answer 5

Basically in my experience, with the size of Joomla there is no way to truly secure it completely. So rather then a perfect security policy that stops it all, its best to bring your expectations down to try and lower the overall damage.

This can be done with an extremely frequent backup policy so that at any intrusion the site can be rolled back, as well as malware scans. So far not one hack we have had was due to our admin panel being brute forced.

Most hacks we see are from third party components or the Joomla core, we have even seen hacks manage to get into the latest versions of Joomla as well. This is because the hack can typically look like a normal request, using bad filtering to push a file onto the server. Once a file is on the server everything is fair game, it can be on ANY site in an entire shared server and still affect yours, so if one person on a shared server does not keep up to date, it can affect you.

This may be a little extreme, but based on personal experience its best to be prepared for the worst, then overconfident that your policy will prevent it all.

So the best way to secure a new Joomla install is to backup often and enable malware scans, if the malware scanner can email you as soon as it finds something, then you can roll back to the latest backup within a very short timeframe.

Answer 6

1. Change username and keep administrator password strong, use two-factor authentication (inbuilt for 3.3+, for others http://www.readybytes.net/labs/two-factor-authentication.html)

2. Install kSecure (http://extensions.joomla.org/extensions/access-a-security/site-security/login-protection/12271)

3. Safeguard your website from various attacks by using this htaccess http://docs.joomla.org/Htaccess_examples_(security)

Answer 7

Borrowing this list from a whitepaper "Pen-testing a Joomla site" found on blog. I think this list is a thorough guideline for the basics of Joomla security.

1. Always keep you Joomla up to date. Install the latest upgrade as soon as the upgrade is released.
2. Whatever extensions are being used, they must be properly patched with latest upgrade releases. Any old extension may give attacker a way to compromise the site.
3. Do not use extensions which have not being used by, or which have not been tested properly.
4. All user inputs must be properly validated. These inputs can be inputs in forms, URI, image uploads, etc. Suppose if a BROWSE button enables the user to upload the image, it must only enable him to upload an image and not a PHP shell which may later work like a backdoor on the server.

5. Use strong passwords for all logins. At least 8 characters, one special character, one number, and one case sensitive letter. It will protect your installation from a brute force.

6. Always keep a track of “Latest Visitors” in the Web Server’s log files for catching potential attacks. Never consider your log files just a piece of information. It is highly useful in tracking and monitoring the users.

7. Put some stress to implement more security to the whole server on which you Joomla based site is hosted; being it hosted on shared server or a dedicated one.

8. Make a list of all the extensions you use and keep monitoring them.

9. Keep yourself up to date with latest vulnerabilities and disclosures at various security advisories. Exploit-db, osvdb, CVE, etc. are some of the good resources.

10. Change the permission on your .htaccess file as it is by default using write permissions (as Joomla has to update it). The best practice is to use 444 (r-xr-xr-x).

11. Proper file permissions on the public directories must be given so that any malicious file must not be uploaded or executed. The best practice in this context is 766 (rwxrw-rw-), i.e. only Owner can read, write and execute. Others can only read and write.

12. No one must have the permission to write into PHP files on the server. They all must be set with 444 (r—r—r--), everyone can read only.

13. Delegate the roles. It makes your Administrator account goes safe. In case someone hacks into your machine, it must have access to the respective user only, and not the administrator account.

14. The database users must only have permission to give commands like INSERT, UPDATE, and DELETE rows. They must not be allowed to DROP tables.

15. Change the names of backend folders, e.g. you can change /administrator to /admin12345. 16. Last but not the least, keep updated with latest vulnerabilities.

    • The complete whitepaper can be found here: http://www.exploit-db.com/wp-content/themes/exploit/docs/22763.pdf

Answer 8

Your first line of defense is your hosting service

• Lease a dedicated server from a reliable hosting service
• Ensure that you activate 2FA on your server and use a 'VERY STRONG' password
• Install a reliable firewall on your server - I use ConfigServer
• Install / Configure an anti-virus program, I use ClamAV
• Ensure that each website username does NOT use the 1st 8 characters of the domain name and uses a 'VERY STRONG' password
• Ensure each website has a SSL certificate installed
• Ensure each website is 'In Jail' meaning they do not have root access unless you need access to the server root. In that case, ensure you have Secure Shell (SSH) installed and configured. I use my server domain website but have all other websites 'In Jail'.
• Ensure that all server updates are installed promptly!!!!

Your next line of defense is your cPanel

• Use a "VERY STRONG" password
• Configure user password strength for users
• Setup a cron job to do a cPanel full backup and save to an external source
• Ensure that cPanel has been setup to use SSL for access
• Run 'Site Security Check' to see what other tweaks may be needed
• Ensure that all cPanel updates are installed promptly!!!!

Your next line of defense is your administrator panel

• Edit the password format requirements to ensure strong passwords (Upper/lower case characters, numbers and at least 1 punctuation mark with a minimum length of 18 characters.
• Enable 2FA for users - Use for Super User and Administrator accounts
• Limit the # of Super User accounts (best to have just one)
• Limit the # of Administrator accounts (the fewer the better)
• Limit the areas that Administrators can access
• Limit the areas that Publishers,Editors and Authors can access
• Install and configure AdminTools
• Setup an administrator URL password via AdminTools
• Ensure that critical files (HTACCESS, ROBOTS.TXT, WEBCONFIG, INDEX.PHP (both root and template) are set to 444. You can still the files edit via cPanel pr Plesk control panel file manager
• Install and configure AkeebaBackup
• Configure AkeebaBackup to save backups externally, offsite
• Only install add-on's via the Joomla Extension pages, never install an add-on from a 3rd party that is not listed on the Joomla Extension page.
• Disable and/or uninstall add-on's that are not used and are not needed for Joomla functionality
• Install Joomla and add-on updates promptly!!!

I'm sure there are other steps but these are the main ones that I use on my server hosting over 70 websites from around the country. I recently had a massive attack similar to a DDoS attack and not one website was accessed. I kind of felt 10 feet tall and bullet proof but I know I can't be complacent as tomorrow is another day! LOL

Answer 9

1. I'm not a fan of two-factor authentication

2. Install Akeeba Admin Tools, enable advanced htaccess, check the options and the software firewall

https://www.akeebabackup.com/download/admin-tools.html

1. Enable backend Url password