After several infections on Joomla we have decided to change to static content (it will require less administration time, and we just change one page per day).

However, we would like to know how Joomla could be attacked so easily. Here I will explain a summary of the changes we unsuccessfully did.

NOTE: we already checked basics and read many Joomla community followers defending its safety.


Is there an easy way to have Joomla really safe from attack penetrations? Any way to know for sure which the last vulnerability was? provided that we improve the installation infection after infection until we have something really lasting.

Please, we are not asking for basics. There is a lot of information over there (repeating information). The installed plugins were minimum, popular and maintained.

Usage history

We began with a Spanish adapted version 2.5.X . First problems arouse (infections) because update dependencies with that distro would not allow an update from the main source of Joomla. The installed version was 2.5.9 and it was already released the version 2.5.28

NOTE: first infections seemed to come from the template ('seemed', because I am not an expert of Joomla).

After getting a proper update to 2.5.28 (last version for 2.5), it was infected again. So we updated to 3.X last version with PDO, preserving only the template (made time before with a free version of some software to make Joomla and Wordpress templates), and installing plugins available for 3.X PDO.

The week that 3.4 was released (if I remember well), it got infected again. This was the drop that spilled the glass. After restoring the backup and updating to the last version, it were added some functionalities such as, double password for the administrator, admin panel forced by https and cached webpages to reduce probability to get infected (I do not know if this last strategy is really effective).

In fact, we wanted to generate a completely static webpage extracting it from Joomla configuration, but I did not find any tool to do so (generate static content from the Admin Panel after every change, and never allow dynamic content to be executed, except for the administration panel)... Finally I installed a cache component (with the limitations it entails in that sense).

Last two infections were in two weeks of difference. At the second one, spam was sent by using system-domain-user@infected-domain.tld (with sendmail, not with authenticated email addresses). So they figured out the apache user and owner of the files at infected-domain.tld . The mail logs increased so significantly that the server went out of disk memory. The server configuration to reject sendmail for forged source email accounts did not work (look here, first answer, to know how header_checks was configured)

We guess that the problem comes from the template. But, how to be sure of that. Every time there is an infection, how can you know where it started? which was the source of the problem? It is like going blind. You just can try some basics to make it safer and hope for updates solving it.

closed as off-topic by Lodder, johanpw, Farahmand, FFrewin, TryHarder Oct 5 '15 at 13:11

  • This question does not appear to be about Joomla! administration and development, within the scope defined in the help center
If this question can be reworded to fit the rules in the help center, please edit the question.

  • You appear to know the basics of making your Joomla site more secure, such as installing a Firewall extension, using Two Factor Authentication, using strong passwords for everything, keep Joomla and all extensions up to date, which is great, however what you're asking I think is a little more advanced, therefore I'd suggest maybe asking your question over at ServerFault or Pro Webmasters – Lodder Oct 2 '15 at 10:42
  • I have a vps server and install this software in my whm. configserver.com/cp/cxs.html i hope this helps. – Max Oct 3 '15 at 1:39
  • Well security is not simple. Detecting vulnerabilities of web applications is out of the scope of this site and as you may understand, it's not a question that can be answered in a few paragraphs, rather it is an advanced topic. Since you are getting continuously compromised, then probably there is a backdoor. Most likely although you have updated, you might not have removed the malware or the backdoor files. In such cases you are hiring an expert to deal with it. – FFrewin Oct 3 '15 at 19:06
  • Thank you guys. I will check for more expertise advice, since this topic is more advanced. – rellampec Oct 6 '15 at 3:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.