Can be administrator directory effectively renamed (for example by simple change in Joomla! core code) for example to admTZ34? The main reason is to obfuscate standard pattern where www.example.com/administrator could be used to check presence of Joomla! installation (in older releases also Joomla! version etc.)
2Before Joomla SE was set up I asked this same question here on SO: stackoverflow.com/questions/15034980/…– tim.bakerMay 5, 2014 at 12:58
It's not really recommended or very simple to do. The admin path gets hardcoded in a lot of extensions with calls to things like JTables which means changing the directory name could have a lot of consequences.
That said if you want to prevent direct access try with one of this solutions:
A) Password protect /administrator with a .htaccess password protection.
This uses HTTP authentication to prevent anyone from getting to the admin directory.
B) Require a keyword in the URL with an extension like:
Admin tools is capable of doing both options for you.
With one of this extensions the admin url will be:
Quick question regarding your first point. Will protecting it using a .htaccess file prevent files being moved the necessary directories within the administrator folder upon installation of extensions?– LodderMay 4, 2014 at 23:59
Continue @ChadWindnagle answer 3) Use two factor authentication extensions.joomla.org/extensions/access-a-security/… May 5, 2014 at 5:10
Nice suggestion on 2 factor. That said I think it's in Joomla 3.2+ so an extension shouldn't be necessary if running latest version of Joomla. May 5, 2014 at 14:10
You can't really change it as it would prevent extensions from installing properly. You can however use Admin Exile which allows you to add a value, key or both to the administrator URL. In addition to this, if the standard admin URL is typed it, it will redirect the user to a site of your choice.
Hope this helps
So if I understand, the main problem is plugins, right? Can it be said that Joomla! installation without extensions can withstand renaming of administrator directory relatively safely?– miroxlavMay 5, 2014 at 0:06
1Extensions in general, not just plugins. There are also other reasons why you should not change the name of the folder. One reason @Chad explains regarding JTables– LodderMay 5, 2014 at 0:07
In addition to that, the whole thought process of renaming /administrator/ in general as a practice is not a good one. It's not "real" security. The author of Akeeba backup and a Joomla security expert wrote about a similar type of move regarding configuration.php [dionysopoulos.me/keep-your-files-where-i-can-see-them/] I'd recommend reading that to understand why this type of change is frowned upon. May 5, 2014 at 0:11
If your only concern is bad-bots identifying your website as joomla website then you need to do a lot more to hide this truth.
A lot of technique exist to identify your website as joomla and its version. This .htaccess file helps in these attacks.