Web Development | Admin | Last Updated: 2011-11-14
With the increasing usage of the Joomla sites, it has become important to secure them from different threats, which pose a potential danger to the security of the site. There are various types of attacks that can be faced by your Joomla site and here are ten tips on how you can avoid them:
For a Joomla website, the server should always be properly configured. The server running PHP in CGI mode with su_php should be chosen so that the PHP is run under your personal account user rather than global Apache user and you are free from citing insecure permissions like CHMOD of 777.
While installation, don't enable the FTP layer as it opens up a potential security hole since your FTP details are stored in plain text under a Joomla! Configuration file FTP layer is not required if your hosting is protected and configured properly for Joomla.
While installation, change the default database prefix to something arbitrary. As hackers try to recover super admin details from jos_users table, most of the SQL injection attacks will stop.
Google inurl: command is used by most of the hackers to exploit vulnerabilities. So, enable SEF URLs through site configuration if you use Joomla 1.5. You can also use extensions like SH404SEF for both Joomla 1.0 and Joomla 1.5. This would prevent hackers from finding exploits and benefit you from SEO perspective.
Never forget to update to the latest release of the Joomla. The recent release is 1.5.11. Subscribe to http://feeds.joomla.org/JoomlaSecurityNews to get updates about the latest security releases. Use official sites to download Joomla! such as the Joomla! Forge, and check the MD5 hash
Keep your password strong for the administrator accounts. For example: E#M!$<9%k. Sites like www.strongpasswordgenerator.com can help to generate a strong password. You should protect your administrative folder with a password. In apache web server, you can do this in htaccess file or in cpanel, Password Protected Directory option helps to setup a password. This will add another layer of username/password before someone reaches your Joomla admin details. Keep this password different from Joomla admin password.
There are more than 4000 extensions including non-commercial extensions that are available for Joomla. But don't install needless extensions on your website. Remember, vulnerability in these extensions results in most hacking attempts. So, always use popular extensions with strong community backing and development process.
The proper file/folder permissions for your Joomla website are:
You can use FTP client to CHMOD the files and folders.
Always rely on a strong backup and recovery protocol for your live website. Apart from hacking, other factors such as hardware failure, hosting provider issues, faulty upgrade or extension install may also compromise your website. You can use a non-commercial component JoomlaPack, native for both Joomla 1.0 and 1.5 for backup. As hackers come up with novel ways of jeopardizing the security of websites, the developers should also stay a step ahead in ensuring proper security at all levels. This can be done by incorporating the tips mentioned here to secure the Joomla website.
Your email address will not be published. Required fields are marked *
Web Development | Jun 03, 2021
WordPress is a CMS that doesn’t require a formal introduction. It is a widely popular CMS utilized worldwide. Right f...