How to prevent Joomla's hidden links from being visited?

Question

Some of Joomla's page can be visited even though there isn't any link to it on the site. One of the infamous examples is when some hacker visits the user registration link even though there isn't any login form on the site. For this we can turn off user registration, but what about other pages?

Some components may have some pages that anyone can visit if they are familiar with the component and know the URL.

This feels like a potential backdoor for malicious users. Is there a common way to prevent this or does this have to be dealt with on a case by case basis?

Answer 1

defined('_JEXEC') or die; can be found at many, many php scripts in the Joomla framework to restrict the number and location of via entry points into your site/application.

https://docs.joomla.org/JEXEC

This is a very deliberate form of security for what you are describing. If you aren't baking this into your new scripts, then you should.

Answer 2

You can check your logs for the pages that you don't want visited, and then develop some .htaccess rules to block access to these pages (or redirect access to the pages to the homepage). The beauty of the .htaccess file is that you will have all this "blocking" logic in one place.