37 votes
Accepted

How to secure a new Joomla installation?

Keeping a Joomla Website Secure Use strong passwords. Minimise the number of administrator accounts. Disable or remove unused user accounts. Minimise the number of third party extensions and where ...
user avatar
30 votes
Accepted

How to detect if user is Super User?

these codes will determine if current logged in user is super user or not - $user = JFactory::getUser(); $isroot = $user->authorise('core.admin'); that code will check what is mapped to the "...
user avatar
  • 1,341
22 votes
Accepted

Recommended practices regarding Joomla file/directory permissions and ownership on linux systems?

There are a few potential causes for file and folder permission issues on Linux hosting. 1. File and Folder Permissions Check folder permissions are set to 0755 and file permissions are set to 0644. ...
user avatar
18 votes
Accepted

Akeeba BackUp: Is it safe to be used?

As the author of Akeeba Backup I have to say that: In nine years we had a total of four security issues, only one being high priority. Even that one required advanced cryptanalytic skills to exploit. ...
user avatar
  • 521
15 votes
Accepted

Renaming of administrator directory

It's not really recommended or very simple to do. The admin path gets hardcoded in a lot of extensions with calls to things like JTables which means changing the directory name could have a lot of ...
user avatar
15 votes

How to stop (fake) users from registering on my website?

Why I find fake/spam registered users in my site…? The majority of such registrations are coming from botnets, infected machines, script kiddys and generally all kind of bots. In systems like Joomla, ...
user avatar
  • 19.5k
14 votes

How to secure a new Joomla installation?

It's very important to store backups on a separate server. I see a lot of people who are faithfully running Akeeba Backups... and they're being stored on the same server in the same root directory. ...
user avatar
14 votes
Accepted

Joomla tmp directory - What is it for and can I delete its content?

You can definitely delete the files in the tmp directory and actually it is strongly recommended to do so and maintain it clean. You should only keep the index.html file in place, that may prevent ...
user avatar
  • 19.5k
14 votes
Accepted

How did hackers manage to create a new user while "allow user registration" is set to "NO"?

The main reason for 3.6.4 update was exactly what happened to you! Security Bulletin [20161001] - Core - Account Creation states "Inadequate checks allows for users to register on a site when ...
user avatar
  • 3,017
13 votes
Accepted

Forbid direct access to INI and XML files

Put this directive inside your .htaccess file: <FilesMatch ".(ini|xml)$"> order allow,deny deny from all </FilesMatch>
user avatar
  • 4,045
12 votes

Recommended practices regarding Joomla file/directory permissions and ownership on linux systems?

Please check the permission levels, it should be 644 and 755 for files and folders respectively. Many times the permission levels are just fine, even when some issues are faced. It means that you ...
user avatar
  • 1,291
12 votes
Accepted

How can I tell if a free template contains malware

Since you're looking for free templates I assume you're not looking to spend extra, but mysites.guru (formerly myjoomla.com) has excellent security scanning. The details of what you're looking for: ...
user avatar
  • 1,079
11 votes

How can I tell if a free template contains malware

Perhaps there is only one safe answer - only download direct from the original creator and preferably from a well known template house. Most of the commercial template devs do at least one free ...
user avatar
11 votes
Accepted

How to stop (fake) users from registering on my website?

Newer versions of Joomla 3.x disable User Registration by default. If your version of Joomla was installed before this change, you probably have User Registration enabled. User Registration can be ...
user avatar
9 votes
Accepted

Index.html files – must these be present in every directory?

From a technical aspect, index.html files are not required, but do prevent directory access on badly configured environments as already noted. If you're looking to list an extension on the Joomla! ...
user avatar
  • 1,590
9 votes

What to do if my Joomla website got hacked?

To keep you website always secured, you need a strict security policy: Update Joomla to the latest version Use ONLY themes from well-known developers (no exceptions), AND update to the latest version ...
user avatar
  • 7,415
9 votes

How (re)set password for admin after migration from 1.5?

Here is a workaround to temporary reset your password for your account. Login to your hosting panel and use the database tool that is available (probably PHPmyAdmin). Load the appropriate database ...
user avatar
  • 19.5k
9 votes

Akeeba BackUp: Is it safe to be used?

Well for starters, Akeeba Backup does not appear to be in the VEL (Vulnerable Extensions List) on the Joomla Extensions Directory. These people have slagged Akeeba Backup for it insecurity, however: ...
user avatar
  • 26.4k
8 votes

Getting too many (flood) request, how can I block/reduce bot requests to my site?

You can use CloudFlare as firewall to your site: http://www.cloudflare.com/features-security
user avatar
  • 225
8 votes

Recommended practices regarding Joomla file/directory permissions and ownership on linux systems?

An easy solution for me is to often let PHP run in (Fast-)CGI mode and to set the ownership of the Joomla directory to the FTP user. So you will be able to upload and overwrite files via FTP and ...
user avatar
  • 3,693
8 votes
Accepted

How to develop safe Joomla extension?

One main thing which you have pointed out is SQL Injection. This is one thing which a few people I've seen seem to miss completely and start developing using non Joomla coding standards and start ...
user avatar
  • 26.4k
8 votes

How to detect if user is Super User?

To determine the "Super User" status you have to check $user->isRoot. This property is set after the first authorise check is done and the user is detected to be super admin. However usually you ...
user avatar
  • 5,527
8 votes

What to do if my Joomla website got hacked?

What I recommend you do straight away is: Create a new installation of Joomla on a subdomain or localhost, Create a super user account with a strong password Copy the password hash from the #__users ...
user avatar
  • 26.4k
8 votes
Accepted

Input filtering an array of integers, words

OK, so let us look at what options are available. The examples below are using JInput and have been tested in Joomla 3.3. I am POSTing the following data at Joomla: stuff[abc]=1 stuff[def]=75 stuff[...
user avatar
8 votes
Accepted

User Login History

I've personally been using Saxum IP logger for a couple of years now. It's a great (FREE) extension that provides information such as: Number of logins for each user (date, IP, etc) Number of ...
user avatar
  • 26.4k
8 votes
Accepted

Is it possible to load a newer jQuery version?

Or does Joomla really need the 1.x version? Joomla itself may work mostly fine with newer jQuery versions. The reason it ships with such an old version is compatibility for 3rd party extensions. So ...
user avatar
  • 8,177
7 votes

Recommended practices regarding Joomla file/directory permissions and ownership on linux systems?

Permissions should be 644 and 755 as explained by Shyam. In Joomla you can avoid all the problems you mentioned ,with following methods. Not being able to transfer files to the server using programs ...
user avatar
  • 1,507
7 votes

Recommended practices regarding Joomla file/directory permissions and ownership on linux systems?

Permissions should be 644 and 755 as explained by Shyam. The problems you are facing are most likely related to the way your server is set up. Most of the time this happens on shared hosts where ...
user avatar
  • 5,527
7 votes

Getting too many (flood) request, how can I block/reduce bot requests to my site?

There is no one solution, you are best off using a combination of solutions. We have some high profile sites that are often targeted so we have adopted these measures - Cloudflare - great service. ...
user avatar
7 votes
Accepted

Getting too many (flood) request, how can I block/reduce bot requests to my site?

If you are using Cpanel or any other linux distribution I would highly suggest using http://configserver.com/cp/csf.html and configuring it. It will reduce the amount of bots that are hitting your ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible