36
Keeping a Joomla Website Secure
Use strong passwords.
Minimise the number of administrator accounts.
Disable or remove unused user accounts.
Minimise the number of third party extensions and where third party extensions are necessary, use well supported extensions from established developers you trust.
Regularly apply the latest updates to Joomla and third ...
28
these codes will determine if current logged in user is super user or not -
$user = JFactory::getUser();
$isroot = $user->authorise('core.admin');
that code will check what is mapped to the "Super User" permission in the global configuration and not in only component level. Check it yourself comparing with other ways.
22
There are a few potential causes for file and folder permission issues on Linux hosting.
1. File and Folder Permissions
Check folder permissions are set to 0755 and file permissions are set to 0644. Note that file and folder permissions can be reset to these standard secure settings on a site wide basis using the free or the paid version of Akeeba Admin ...
18
As the author of Akeeba Backup I have to say that:
In nine years we had a total of four security issues, only one being high priority. Even that one required advanced cryptanalytic skills to exploit. It only applied when an optional feature was enabled. We patched it in ALL versions of our software, even those. It supported for four years. The security ...
15
It's not really recommended or very simple to do. The admin path gets hardcoded in a lot of extensions with calls to things like JTables which means changing the directory name could have a lot of consequences.
That said if you want to prevent direct access try with one of this solutions:
A) Password protect /administrator with a .htaccess password ...
14
It's very important to store backups on a separate server. I see a lot of people who are faithfully running Akeeba Backups... and they're being stored on the same server in the same root directory. Not so helpful if you are hacked in a serious way, and certainly not helpful to recover from a hosting failure.
Akeeba Backup Pro allows you to store and manage ...
14
You can definitely delete the files in the tmp directory and actually it is strongly recommended to do so and maintain it clean.
You should only keep the index.html file in place, that may prevent potential directory listing of the files.
The tmp (temporary) folder is used by Joomla and its extensions when performing software installations or during the ...
14
Why I find fake/spam registered users in my site…?
The majority of such registrations are coming from botnets, infected machines, script kiddys and generally all kind of bots.
In systems like Joomla, where the location of the user registration form is well known and by default public accessible, it's easy to start filling up and submitting the forms.
...
14
The main reason for 3.6.4 update was exactly what happened to you!
Security Bulletin [20161001] - Core - Account Creation states
"Inadequate checks allows for users to register on a site when registration has been disabled."
Then, additional vulnerability which was fixed by 3.6.4 was [20161002] - Core - Elevated Privileges "Incorrect use of unfiltered ...
12
Put this directive inside your .htaccess file:
<FilesMatch ".(ini|xml)$">
order allow,deny
deny from all
</FilesMatch>
12
Please check the permission levels, it should be 644 and 755 for files and folders respectively.
Many times the permission levels are just fine, even when some issues are faced. It means that you will have to check the the ownership and group of the specific files and folders. Normally the group and ownership can be changed to www-data for apache (used in ...
11
Newer versions of Joomla 3.x disable User Registration by default.
If your version of Joomla was installed before this change, you probably have User Registration enabled.
User Registration can be disabled by setting Users -> Manage -> Options -> Allow User Registration to "No".
You can then delete all users except the Super Administrator account....
10
Perhaps there is only one safe answer - only download direct from the original creator and preferably from a well known template house. Most of the commercial template devs do at least one free template. Do your research on the creator as much as the template ;)
10
Since you're looking for free templates I assume you're not looking to spend extra, but myjoomla.com has excellent security scanning.
The details of what you're looking for:
start with looking for any inserted iframes.
Then look for any php files that are not the index.php or component.php, etc layout files..and if you see anything besides Joomla ...
9
From a technical aspect, index.html files are not required, but do prevent directory access on badly configured environments as already noted.
If you're looking to list an extension on the Joomla! Extensions Directory, (JED) it is not required to have index.html files; this change was made somewhere around March 2013.
You can use the JEDChecker extension ...
9
Here is a workaround to temporary reset your password for your account.
Login to your hosting panel and use the database tool that is available (probably PHPmyAdmin).
Load the appropriate database and then go to the jos_users table. (The database prefix might be different for your case).
Go to the browse view of the PHPmyAdmin, so you get view of the ...
9
Well for starters, Akeeba Backup does not appear to be in the VEL (Vulnerable Extensions List) on the Joomla Extensions Directory.
These people have slagged Akeeba Backup for it insecurity, however:
Have they contacted the developer?
Have they reported it on JED?
Do they have solid evidence? (shared privately for the time being)
Due to the popularity of ...
8
You can use CloudFlare as firewall to your site:
http://www.cloudflare.com/features-security
8
An easy solution for me is to often let PHP run in (Fast-)CGI mode and to set the ownership of the Joomla directory to the FTP user. So you will be able to upload and overwrite files via FTP and Joomla will be able to write files too.
A way to do this on a shared hosting environment (if it is allowed), is to add something like this to your .htaccess file:
...
8
One main thing which you have pointed out is SQL Injection. This is one thing which a few people I've seen seem to miss completely and start developing using non Joomla coding standards and start writing SQL queires using mysql_* commands.
Second thing which I kind of mentioned in the first point, which is always stick to Joomla coding standards. The only ...
8
To determine the "Super User" status you have to check $user->isRoot.
This property is set after the first authorise check is done and the user is detected to be super admin.
However usually you indeed better want to check if the user has certain permissions like described on the other answers.
8
I've personally been using Saxum IP logger for a couple of years now. It's a great (FREE) extension that provides information such as:
Number of logins for each user (date, IP, etc)
Number of different IP addresses each user has used to login
Ability to block IP's
And other nice features
The first screenshot below is a snippet of all the users that have ...
7
Permissions should be 644 and 755 as explained by Shyam.
In Joomla you can avoid all the problems you mentioned ,with following methods.
Not being able to transfer files to the server using programs such as WinSCP.
This may happen due to permission of (444) like Joomla configuration.php have this permission its doesn't allow by default(for security).
...
7
Permissions should be 644 and 755 as explained by Shyam.
The problems you are facing are most likely related to the way your server is set up. Most of the time this happens on shared hosts where Apache runs under a different user than your FTP account. Since you usually upload Joomla using FTP, Apache isn't the owner of the file and thus doesn't have the ...
7
There is no one solution, you are best off using a combination of solutions. We have some high profile sites that are often targeted so we have adopted these measures -
Cloudflare - great service. The bogus requests never make it to your server and their caching will save you considerable bandwidth. They filter the vast majority of bad requests.
Admin tools ...
7
If you are using Cpanel or any other linux distribution I would highly suggest using http://configserver.com/cp/csf.html and configuring it. It will reduce the amount of bots that are hitting your server and using up your resources.
7
As an alternative to .htaccess file or locking it down by IP, you can also use jSecure to secure your admin login.
One thing that hasn't been mentioned is using a reputable hosting provider. You want one that not only keeps up with security but will also work with you if you are hacked or there is a problem (database gets corrupted for example). The idea ...
7
Short and long answer is no. You need to upgrade a 1.6 or 1.7 site to at least 2.5.x as that is the most secure version (although 2.5 is fast approaching end-of-life). If you have a compatible template, you might be able to upgrade to 3.3.
7
Following the official documentation, here are some steps on the topic Secure coding guidelines:
Validate any data you get from the request (POST, GET, COOKIES, etc.). Don't trust the user and be as strict as possible. If you expect an integer, don't allow a string to be accepted.
File uploads - avoid, whenever possible, accepting file on public web pages. ...
7
What I recommend you do straight away is:
Create a new installation of Joomla on a subdomain or localhost,
Create a super user account with a strong password
Copy the password hash from the #__users table from your newly created account and replace the old one.
I'm not sure how the hashes and usernames were changed but it could be down a few reasons. ...
Only top voted, non community-wiki answers of a minimum length are eligible
