9

Can be administrator directory effectively renamed (for example by simple change in Joomla! core code) for example to admTZ34? The main reason is to obfuscate standard pattern where www.example.com/administrator could be used to check presence of Joomla! installation (in older releases also Joomla! version etc.)

15

It's not really recommended or very simple to do. The admin path gets hardcoded in a lot of extensions with calls to things like JTables which means changing the directory name could have a lot of consequences.

That said if you want to prevent direct access try with one of this solutions:

A) Password protect /administrator with a .htaccess password protection.
This uses HTTP authentication to prevent anyone from getting to the admin directory.

http://httpd.apache.org/docs/current/programs/htpasswd.html

B) Require a keyword in the URL with an extension like:

  • AdminExile
  • JSecure
  • KSecure
  • Admin Tools

    Admin tools is capable of doing both options for you.

    With one of this extensions the admin url will be:
    yoursite.com/administrator/?mySpecialPhrase

  • Quick question regarding your first point. Will protecting it using a .htaccess file prevent files being moved the necessary directories within the administrator folder upon installation of extensions? – Lodder May 4 '14 at 23:59
  • 3
    I don't believe so because .htpasswd will only check for http access. When copying files around via the installer I think all that happens at the server level so I don't think this will matter. That said, I have seen issues with things like javascript being stored in /administrator and being called via HTTP on the front end and asking users to login. So this isn't always a workable solution. – Chad Windnagle May 5 '14 at 0:07
  • @ChadWindnagle +1 from my side in your answer and your comments. Backend Protection through htaccess is a good solution but few extension fetch site's images and javascript from site's backend, In-that case htaccess restrict to access these images and javascripts. – Manish Trivedi May 5 '14 at 5:09
  • Continue @ChadWindnagle answer 3) Use two factor authentication extensions.joomla.org/extensions/access-a-security/… – Manish Trivedi May 5 '14 at 5:10
  • Nice suggestion on 2 factor. That said I think it's in Joomla 3.2+ so an extension shouldn't be necessary if running latest version of Joomla. – Chad Windnagle May 5 '14 at 14:10
4

You can't really change it as it would prevent extensions from installing properly. You can however use Admin Exile which allows you to add a value, key or both to the administrator URL. In addition to this, if the standard admin URL is typed it, it will redirect the user to a site of your choice.

http://extensions.joomla.org/extensions/access-a-security/site-security/login-protection/15711

Hope this helps

  • So if I understand, the main problem is plugins, right? Can it be said that Joomla! installation without extensions can withstand renaming of administrator directory relatively safely? – miroxlav May 5 '14 at 0:06
  • 1
    Extensions in general, not just plugins. There are also other reasons why you should not change the name of the folder. One reason @Chad explains regarding JTables – Lodder May 5 '14 at 0:07
  • In addition to that, the whole thought process of renaming /administrator/ in general as a practice is not a good one. It's not "real" security. The author of Akeeba backup and a Joomla security expert wrote about a similar type of move regarding configuration.php [dionysopoulos.me/keep-your-files-where-i-can-see-them/] I'd recommend reading that to understand why this type of change is frowned upon. – Chad Windnagle May 5 '14 at 0:11
2

If your only concern is bad-bots identifying your website as joomla website then you need to do a lot more to hide this truth.

A lot of technique exist to identify your website as joomla and its version. This .htaccess file helps in these attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.