37
votes
Accepted
How to secure a new Joomla installation?
Keeping a Joomla Website Secure
Use strong passwords.
Minimise the number of administrator accounts.
Disable or remove unused user accounts.
Minimise the number of third party extensions and where ...
- 7,824
30
votes
Accepted
How to detect if user is Super User?
these codes will determine if current logged in user is super user or not -
$user = JFactory::getUser();
$isroot = $user->authorise('core.admin');
that code will check what is mapped to the "...
- 1,341
22
votes
Accepted
Recommended practices regarding Joomla file/directory permissions and ownership on linux systems?
There are a few potential causes for file and folder permission issues on Linux hosting.
1. File and Folder Permissions
Check folder permissions are set to 0755 and file permissions are set to 0644. ...
- 7,824
18
votes
Accepted
Akeeba BackUp: Is it safe to be used?
As the author of Akeeba Backup I have to say that:
In nine years we had a total of four security issues, only one being high priority. Even that one required advanced cryptanalytic skills to exploit. ...
- 521
15
votes
Accepted
Renaming of administrator directory
It's not really recommended or very simple to do. The admin path gets hardcoded in a lot of extensions with calls to things like JTables which means changing the directory name could have a lot of ...
- 949
15
votes
How to stop (fake) users from registering on my website?
Why I find fake/spam registered users in my site…?
The majority of such registrations are coming from botnets, infected machines, script kiddys and generally all kind of bots.
In systems like Joomla, ...
- 19.5k
14
votes
How to secure a new Joomla installation?
It's very important to store backups on a separate server. I see a lot of people who are faithfully running Akeeba Backups... and they're being stored on the same server in the same root directory. ...
- 339
14
votes
Accepted
Joomla tmp directory - What is it for and can I delete its content?
You can definitely delete the files in the tmp directory and actually it is strongly recommended to do so and maintain it clean.
You should only keep the index.html file in place, that may prevent ...
- 19.5k
14
votes
Accepted
How did hackers manage to create a new user while "allow user registration" is set to "NO"?
The main reason for 3.6.4 update was exactly what happened to you!
Security Bulletin [20161001] - Core - Account Creation states
"Inadequate checks allows for users to register on a site when ...
- 3,017
13
votes
Accepted
Forbid direct access to INI and XML files
Put this directive inside your .htaccess file:
<FilesMatch ".(ini|xml)$">
order allow,deny
deny from all
</FilesMatch>
- 4,045
12
votes
Recommended practices regarding Joomla file/directory permissions and ownership on linux systems?
Please check the permission levels, it should be 644 and 755 for files and folders respectively.
Many times the permission levels are just fine, even when some issues are faced. It means that you ...
- 1,291
12
votes
Accepted
How can I tell if a free template contains malware
Since you're looking for free templates I assume you're not looking to spend extra, but mysites.guru (formerly myjoomla.com) has excellent security scanning.
The details of what you're looking for:
...
- 1,079
11
votes
How can I tell if a free template contains malware
Perhaps there is only one safe answer - only download direct from the original creator and preferably from a well known template house. Most of the commercial template devs do at least one free ...
- 111
11
votes
Accepted
How to stop (fake) users from registering on my website?
Newer versions of Joomla 3.x disable User Registration by default.
If your version of Joomla was installed before this change, you probably have User Registration enabled.
User Registration can be ...
- 7,824
9
votes
Accepted
Index.html files – must these be present in every directory?
From a technical aspect, index.html files are not required, but do prevent directory access on badly configured environments as already noted.
If you're looking to list an extension on the Joomla! ...
- 1,590
9
votes
What to do if my Joomla website got hacked?
To keep you website always secured, you need a strict security policy:
Update Joomla to the latest version
Use ONLY themes from well-known developers (no exceptions), AND update to the latest version
...
- 7,415
9
votes
How (re)set password for admin after migration from 1.5?
Here is a workaround to temporary reset your password for your account.
Login to your hosting panel and use the database tool that is available (probably PHPmyAdmin).
Load the appropriate database ...
- 19.5k
9
votes
Akeeba BackUp: Is it safe to be used?
Well for starters, Akeeba Backup does not appear to be in the VEL (Vulnerable Extensions List) on the Joomla Extensions Directory.
These people have slagged Akeeba Backup for it insecurity, however:
...
- 26.4k
8
votes
Getting too many (flood) request, how can I block/reduce bot requests to my site?
You can use CloudFlare as firewall to your site:
http://www.cloudflare.com/features-security
- 225
8
votes
Recommended practices regarding Joomla file/directory permissions and ownership on linux systems?
An easy solution for me is to often let PHP run in (Fast-)CGI mode and to set the ownership of the Joomla directory to the FTP user. So you will be able to upload and overwrite files via FTP and ...
- 3,693
8
votes
Accepted
How to develop safe Joomla extension?
One main thing which you have pointed out is SQL Injection. This is one thing which a few people I've seen seem to miss completely and start developing using non Joomla coding standards and start ...
- 26.4k
8
votes
How to detect if user is Super User?
To determine the "Super User" status you have to check $user->isRoot.
This property is set after the first authorise check is done and the user is detected to be super admin.
However usually you ...
- 5,527
8
votes
What to do if my Joomla website got hacked?
What I recommend you do straight away is:
Create a new installation of Joomla on a subdomain or localhost,
Create a super user account with a strong password
Copy the password hash from the #__users ...
- 26.4k
8
votes
Accepted
Input filtering an array of integers, words
OK, so let us look at what options are available. The examples below are using JInput and have been tested in Joomla 3.3.
I am POSTing the following data at Joomla:
stuff[abc]=1
stuff[def]=75
stuff[...
- 3,640
8
votes
Accepted
User Login History
I've personally been using Saxum IP logger for a couple of years now. It's a great (FREE) extension that provides information such as:
Number of logins for each user (date, IP, etc)
Number of ...
- 26.4k
8
votes
Accepted
Is it possible to load a newer jQuery version?
Or does Joomla really need the 1.x version?
Joomla itself may work mostly fine with newer jQuery versions. The reason it ships with such an old version is compatibility for 3rd party extensions.
So ...
- 8,177
7
votes
Recommended practices regarding Joomla file/directory permissions and ownership on linux systems?
Permissions should be 644 and 755 as explained by Shyam.
In Joomla you can avoid all the problems you mentioned ,with following methods.
Not being able to transfer files to the server using programs ...
- 1,507
7
votes
Recommended practices regarding Joomla file/directory permissions and ownership on linux systems?
Permissions should be 644 and 755 as explained by Shyam.
The problems you are facing are most likely related to the way your server is set up. Most of the time this happens on shared hosts where ...
- 5,527
7
votes
Getting too many (flood) request, how can I block/reduce bot requests to my site?
There is no one solution, you are best off using a combination of solutions. We have some high profile sites that are often targeted so we have adopted these measures -
Cloudflare - great service. ...
- 241
7
votes
Accepted
Getting too many (flood) request, how can I block/reduce bot requests to my site?
If you are using Cpanel or any other linux distribution I would highly suggest using http://configserver.com/cp/csf.html and configuring it. It will reduce the amount of bots that are hitting your ...
- 134
Only top scored, non community-wiki answers of a minimum length are eligible