I would like to redirect any trafic which tries to acces com_users (any view) or the frontpage editing (index.php?option=com_content&view=form&layout=edit) to the frontpage.

I don't want to use any extensions for this, so I'm looking for a solution with .htaccess and web.config

I'm not so familiar with rewrite conditions so I'm sure I doing it the wrong way. But couldn't figure out the right.

For example I tried this for web.config:

<rule name="Joomla! Rule 3, Deny com_users and editing">
    <match url="^(.*)$" ignoreCase="false" />
    <conditions logicalGrouping="MatchAny">
        <add input="{QUERY_STRING}" pattern="/?option=com_users" />
        <add input="{QUERY_STRING}" pattern="layout=edit" />
        <add input="{REQUEST_FILENAME}" pattern="index.php" />
    <action type="Rewrite" url="index.php" />

end this for .htaccess:

# If the requested path and file is not /index.php and the request
# has not already been internally rewritten to the index.php script
RewriteCond %{REQUEST_URI} !^/index\.php
RewriteCond %{REQUEST_URI} com_users #added this to the original Joomla! code
RewriteCond %{REQUEST_URI} edit #added this to the original Joomla! code
# and the requested path and file doesn't directly match a physical file
RewriteCond %{REQUEST_FILENAME} !-f
# and the requested path and file doesn't directly match a physical folder
RewriteCond %{REQUEST_FILENAME} !-d
# internally rewrite the request to the index.php script
RewriteRule .* index.php [L]

2 Answers 2


If you want to block access to certain url parameters/values like the option=com_users in the front end, you can try something like:

RewriteCond %{REQUEST_URI} !^/administrator/.*
RewriteCond %{QUERY_STRING} (^|&)option=(com_users)
RewriteRule ^(.*) - [F]

What the above does is:

  1. Instructing to exclude the administrator site and it's required, otherwise you won't be able to access the com_users in admin site as well.
  2. Checking for the query sting option=com_users in the url
  3. Forbids access to it.
  • Thanks, It works perfectly on Linux servers but I don't know why IIS ignores admin exclusion. Maybe I should use rewrite map instead of a simple rule. I will investigate it further. Oh and also I came up with a hack for the front end editing :) I added a simple code to my template which looks like this: if(strpos($_SERVER['REQUEST_URI'], 'edit' !== false){header("Location: http://mydomain.com/");} and I'm also considering changing the file rights for edit to 444 so this way PHP can't execute the file :)
    – Laci K
    Jan 9, 2016 at 19:22

Why you dont try Admin Exile plugin? This plugin do exactly you need, and is free.


I hope this helps.

  • This will only protect access to administrator and restrict user groups on front end, but I already protect back end with OSE Security plug-in. Anyway Thanks for the answer.
    – Laci K
    Jan 9, 2016 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.