4

Is Joomla backend without https:// secure from hackers grabbing the password and login details?

Can you get away without having an ssl certificate for a very basic site with no e-commerce or data entered by users? The only thing at risk being the Webmasters admin details for the backend.

Any thoughts?

Improve this question
1
  • Joomla 3.x uses bcrypt password encryption which is one of the best so for the backend login, SSL is not required. For an e-commerce site, it's not mandatory, but it should be done. Joomla 2.5 uses md5 + salt which is secure, but not as good. – Lodder Nov 15 '14 at 18:56
5

SSL certificates are a means of protecting against "man in the middle" attacks: http://en.wikipedia.org/wiki/Man-in-the-middle_attack.

Without an SSL certificate it is possible for the request from your browser to the server to be intercepted and for the interceptor to read your password out of the request, since the password will just be in plain text.

If you are using an SSL certificate, then the request would be encrypted, so even though the request could be intercepted, the interceptor would have to decrypt the request to be able to see the password.

Ideally, you would have an SSL certificate, and there is a big push to get more and more sites using SSL certificates, such as Google now factoring whether a site supports SSL into their rankings: http://searchengineland.com/google-starts-giving-ranking-boost-secure-httpsssl-sites-199446.

There are really 2 key takeaways from this:

  1. The data is only at risk while the request is being made. A hacker has to be able to do a man in the middle attack to benefit from the lack of an SSL certificate. This is obviously a possibility, but typically not the biggest risk for a small, non-ecommerce site.

  2. The reason that Joomla does not default to SSL for the admin page is that SSL is required to be installed on the server, not provided by code that you can just download. Since basically all Joomla is self-hosted, you have to work with your hosting provider to add the SSL certificate.

I highly recommend adding one if you can. There are even free certificates available here: https://www.startssl.com/. Many hosts charge an install fee though, so rarely can you get away without any cost to adding the certificate.

Improve this answer
2
  • Also most shared hostings provide shared IP address but SSL requires a dedicated IP address and changing the IP address may take several hours to resolve. – Farahmand Nov 16 '14 at 10:10
  • And there is typically an extra charge for the dedicated ip. – David Fritsch Nov 16 '14 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.