Can be administrator directory effectively renamed (for example by simple change in Joomla! core code) for example to admTZ34? The main reason is to obfuscate standard pattern where www.example.com/administrator could be used to check presence of Joomla! installation (in older releases also Joomla! version etc.)


3 Answers 3


It's not really recommended or very simple to do. The admin path gets hardcoded in a lot of extensions with calls to things like JTables which means changing the directory name could have a lot of consequences.

That said if you want to prevent direct access try with one of this solutions:

A) Password protect /administrator with a .htaccess password protection.
This uses HTTP authentication to prevent anyone from getting to the admin directory.


B) Require a keyword in the URL with an extension like:

  • AdminExile
  • JSecure
  • KSecure
  • Admin Tools

    Admin tools is capable of doing both options for you.

    With one of this extensions the admin url will be:

  • Quick question regarding your first point. Will protecting it using a .htaccess file prevent files being moved the necessary directories within the administrator folder upon installation of extensions?
    – Lodder
    May 4, 2014 at 23:59
  • 3
    I don't believe so because .htpasswd will only check for http access. When copying files around via the installer I think all that happens at the server level so I don't think this will matter. That said, I have seen issues with things like javascript being stored in /administrator and being called via HTTP on the front end and asking users to login. So this isn't always a workable solution. May 5, 2014 at 0:07
  • @ChadWindnagle +1 from my side in your answer and your comments. Backend Protection through htaccess is a good solution but few extension fetch site's images and javascript from site's backend, In-that case htaccess restrict to access these images and javascripts. May 5, 2014 at 5:09
  • Continue @ChadWindnagle answer 3) Use two factor authentication extensions.joomla.org/extensions/access-a-security/… May 5, 2014 at 5:10
  • Nice suggestion on 2 factor. That said I think it's in Joomla 3.2+ so an extension shouldn't be necessary if running latest version of Joomla. May 5, 2014 at 14:10

You can't really change it as it would prevent extensions from installing properly. You can however use Admin Exile which allows you to add a value, key or both to the administrator URL. In addition to this, if the standard admin URL is typed it, it will redirect the user to a site of your choice.


Hope this helps

  • So if I understand, the main problem is plugins, right? Can it be said that Joomla! installation without extensions can withstand renaming of administrator directory relatively safely?
    – miroxlav
    May 5, 2014 at 0:06
  • 1
    Extensions in general, not just plugins. There are also other reasons why you should not change the name of the folder. One reason @Chad explains regarding JTables
    – Lodder
    May 5, 2014 at 0:07
  • In addition to that, the whole thought process of renaming /administrator/ in general as a practice is not a good one. It's not "real" security. The author of Akeeba backup and a Joomla security expert wrote about a similar type of move regarding configuration.php [dionysopoulos.me/keep-your-files-where-i-can-see-them/] I'd recommend reading that to understand why this type of change is frowned upon. May 5, 2014 at 0:11

If your only concern is bad-bots identifying your website as joomla website then you need to do a lot more to hide this truth.

A lot of technique exist to identify your website as joomla and its version. This .htaccess file helps in these attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.