Joomla Hack – Protecting Your Site from Hacking

To protect a site created on the Joomla engine from hacking, you need to perform a number of simple steps:

• 1. Set an administrator password. If this function is not provided by the hosting panel, it can be done manually. To do this, you need to create a .htaccess file in the root directory and enter the following lines there:

  AuthName "arbitrary_text"
  AuthType Basic 
  Require valid-user
  AuthUserFile "full_path_to *file*.htpasswd"

  In AuthName, enter a text describing what is being protected. In AuthUserFile, enter the full path to the .htpasswd file. To maximize the security of your site, create a separate directory on the hosting where network access will be denied. Example of full path to file - /var/www/vhosts/test-account.pp.ua/.htpasswd or in the case of Windows operating system: c:/my_site/.htpasswd.
  The .htpasswd file is created with a utility that comes with the Apache web server. Run the following command:

  htpasswd -bc .htpasswd username user_password

  When the process is complete, move the file to the location specified in the AuthUserFile directive.
  After completing these settings, to access the protected directory or page, you will need to additionally enter a login and password.

• 2. Hide the fact that the site runs on Joomla
  • 2.1 Do not use default table prefixes (jos_ in Joomla 1.5) in the database.
  • 2.2 Replace or delete <meta name="generator" content="Joomla! 1.5 - Open Source Content Management" />. This will significantly reduce the risk of your site being hacked. To do this, in the index.php file, enter the code <?php $this->setGenerator('Your-Site.ru'); ?>.
  • 2.3 Disable viewing of module positions in the site template (they can be viewed at domain.ru/?tp=1). This only applies to Joomla 1.5; in versions 1.6, 1.7 and 2.5 it is disabled by default.
  • 2.4 Using SEF. In the process of generating links, be sure to use SEF.
• 3. Delete unused Joomla files
  • 3.1 Delete all components, templates, and plugins that are not used.
  • 3.2 Get rid of files responsible for password reset and recovery. You can delete either the entire com_user folder (in the /components folder) or the file responsible for reset - reset.php (in the /components/com_user/models folder).
• 4. Restrict permissions. To restrict access to folders and files, use the following rights:

  templates 555 (recursively)
  files in root directory 444
  tmp folder 705
  logs folder 705

• 5. To detect viruses in Joomla as soon as they appear, we recommend using Eyesite, jFireWall, RSFirewall.

If you don't want to spend time on this but want to be sure your site is secure, use the services of UkrHost company. We provide not only hosting and domains, but also website maintenance. Our highly qualified employees will ensure the highest possible level of protection for your page.