Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
3

I do not see this as a Joomla issue (except the .htaccess file in Joomla root). From the small part of the log you provided in your question we can clearly read that the requests are made by mod_pagespeed and Serf as client. There is not really a question about it. The log identifies this user-agent info (Serf used by pagespeed). You cannot just simply avoid ...


2

It’s a good question and a bad question at the same time. Why? Good, because the question sounds ‘exotic’ for many many Joomla users/superusers. Why this small line of code is there everywhere like the coca-cola of Joomla. :) 'Nobody' understands why it works that much. defined('_JEXEC') or die('gooo to hell!'); The question is bad because in the Joomla ...


2

Your first line of defense is your hosting service Lease a dedicated server from a reliable hosting service Ensure that you activate 2FA on your server and use a 'VERY STRONG' password Install a reliable firewall on your server - I use ConfigServer Install / Configure an anti-virus program, I use ClamAV Ensure that each website username does NOT use the 1st ...


1

There is a good video from Joomla World Conference 2016 on a presentation of Namespaces by Jisse Reitsma that around the 23 minute mark goes into an example that eventually describes a situation where you would not use Jexec in your code so that it can be shared with other platforms like Wordpress/Magento, https://www.youtube.com/watch?v=Dyx05GR4Bms With a ...


1

If you are creating a test questionnaire page where visitors fill out test questions as guests and submit their answers, then the whole process is usually handled by secure session/user/csrf tokens which is (created and) submitted together with their filled out tests Forms. The questionnaire Form should include fields like name, email address and CSRF form ...


1

You can check your logs for the pages that you don't want visited, and then develop some .htaccess rules to block access to these pages (or redirect access to the pages to the homepage). The beauty of the .htaccess file is that you will have all this "blocking" logic in one place.


1

defined('_JEXEC') or die; can be found at many, many php scripts in the Joomla framework to restrict the number and location of via entry points into your site/application. https://docs.joomla.org/JEXEC This is a very deliberate form of security for what you are describing. If you aren't baking this into your new scripts, then you should.


1

Sometimes it helps (as a troubleshooting step at least) to disable mod_security. With many hosts, this can be done by adding the following code to your .htaccess file: <IfModule mod_security.c> SecFilterEngine Off SecFilterScanPOST Off </IfModule> See https://stackoverflow.com/a/12928404/1983389 for more details.


1

As at Joomla 3.9.0, there is a new "User Actions Log" included in the Joomla core which tracks logins, extension updates and extension configuration updates, for example. Remember to enable the appropriate user actions plugins for this to work.


Only top voted, non community-wiki answers of a minimum length are eligible