How to Protect Your Joomla Sites

With the increasing usage of the Joomla sites, it has become important to secure them from different threats, which pose a potential danger to the security of the site. There are various types of attacks that can be faced by your Joomla site and here are ten tips on how you can avoid them:

Proper Hosting Environment

For a Joomla website, the server should always be properly configured. The server running PHP in CGI mode with su_php should be chosen so that the PHP is run under your personal account user rather than global Apache user and you are free from citing insecure permissions like CHMOD of 777.

• Set register_globals OFF
• Disable allow_url_fopen
• Adjust the magic_quotes_gpc directive as required for your site. The suggested setting for Joomla! 1.0.x is ON to protect from poorly-written extensions. Joomla! 1.5 ignores this setting and functions properly both ways.
• Dont use PHP safe_mode

Disable FTP Layer

While installation, don't enable the FTP layer as it opens up a potential security hole since your FTP details are stored in plain text under a Joomla! Configuration file FTP layer is not required if your hosting is protected and configured properly for Joomla.

Change the Default Database Prefix (jos_)

While installation, change the default database prefix to something arbitrary. As hackers try to recover super admin details from jos_users table, most of the SQL injection attacks will stop.

Enable SEF URLs

Google inurl: command is used by most of the hackers to exploit vulnerabilities. So, enable SEF URLs through site configuration if you use Joomla 1.5. You can also use extensions like SH404SEF for both Joomla 1.0 and Joomla 1.5. This would prevent hackers from finding exploits and benefit you from SEO perspective.

Upgrade to latest release of Joomla

Never forget to update to the latest release of the Joomla. The recent release is 1.5.11. Subscribe to http://feeds.joomla.org/JoomlaSecurityNews to get updates about the latest security releases. Use official sites to download Joomla! such as the Joomla! Forge, and check the MD5 hash

Strong Password

Keep your password strong for the administrator accounts. For example: E#M!$<9%k. Sites like www.strongpasswordgenerator.com can help to generate a strong password. You should protect your administrative folder with a password. In apache web server, you can do this in htaccess file or in cpanel, Password Protected Directory option helps to setup a password. This will add another layer of username/password before someone reaches your Joomla admin details. Keep this password different from Joomla admin password.

Third party extensions

There are more than 4000 extensions including non-commercial extensions that are available for Joomla. But don't install needless extensions on your website. Remember, vulnerability in these extensions results in most hacking attempts. So, always use popular extensions with strong community backing and development process.

Proper file/folder permissions

The proper file/folder permissions for your Joomla website are:

• Config files: 666
• PHP files: 644
• Other folders: 755

You can use FTP client to CHMOD the files and folders.

Setup a Backup and Recovery Process

Always rely on a strong backup and recovery protocol for your live website. Apart from hacking, other factors such as hardware failure, hosting provider issues, faulty upgrade or extension install may also compromise your website. You can use a non-commercial component JoomlaPack, native for both Joomla 1.0 and 1.5 for backup. As hackers come up with novel ways of jeopardizing the security of websites, the developers should also stay a step ahead in ensuring proper security at all levels. This can be done by incorporating the tips mentioned here to secure the Joomla website.