CentrioHost Blog

Stories and News from IT Industry, Reviews & Tips | Technology Blog


Optimize Joomla Security and Prevent Getting Hacked

  • Category : Website Security
  • Posted on : Apr 01, 2011
  • Views : 1,481
  • By : Naftali P.
Joomla! is a great CMS that is used worldwide. For this reason, hackers often try to find a way to hack a Joomla! website. Here are 7 tips to optimize your Joomla! security, preventing your Joomla! website getting hacked.
 

Always remember to make a regular backup of your website and database. If you still get hacked, you can always get back to an older version of your website. Make sure you find out which extension caused the vulnerability and un-install it.

CHANGE THE DEFAULT DATABASE PREFIX (JOS_)

Most SQL injections that are written to hack a Joomla! website, try to retrieve data from the jos_users table. This way, they can retrieve the username and password from the super administrator of the website. Changing the default prefix into something random, will prevent (most / all) SQL injections.
You can set the database prefix when installing your Joomla! website. If you've already installed Joomla! and want to change your prefix, do the following:
  1. Log on to your Joomla! back-end.
  2. Go to your global configuration and search for the database
  3. Change your database prefix (Example: fdasqw_) and press Save.
  4. Go to phpMyAdmin to access your database.
  5. Go to export, leave all default values and press Start. Exporting the database can take a while.
  6. When done, select all code and copy it to notepad (or any other text editor)
  7. In phpMyAdmin, select all tables and delete them
  8. In notepad, do a Search & replace (Ctrl + H). Set the searchterm to jos_ and change it into your new prefix (Example: fdasqw_). Press "Replace all".
  9. Select everything in your notepad file and copy it. In phpMyAdmin, go to SQL, paste the queries and press Start

REMOVE VERSION NUMBER / NAME OF EXTENSIONS

Most vulnerabilities only occur in a specific release of a specific extension. Showing MyExtension version 2.14 is a really bad thing. You can modify this message to only the name of the extension by doing the following:
  1. Retrieve all files of the extension from your server.
  2. Open up Dreamweaver.
  3. Load any file from the extension that you just downloaded to your local machine.
  4. Use the Search function and set the search to Search through specified folder. Navigate to the folder where you downloaded the exploit to.
  5. Set the search term to "MyExtension version 2.14" and press OK.
  6. When found the correct file, remove the version number.
  7. Upload the changed file to your server and check if the changes are made. 

USE A SEF COMPONENT

Most hackers use the Google inurl: command to search for a vulnerable exploit. Use ArtioSH404SEF or another SEF component to re-write your URL's and prevent hackers from finding the exploits.
Additionally, you'll get a higher rank in Google when using search engine friendly URL's. 

KEEP JOOMLA! AND EXTENSIONS UP TO DATE

This one is pretty obvious. Always check for the latest versions of Joomla! and the extensions you're using. Many vulnerabilities are resolved most of the times in later versions. 

USE THE CORRECT CHMOD FOR EACH FOLDER AND FILE

Setting files or folders to a CHMOD of 777 or 707 is only necessary when a script needs to write to that file or directory. All other files should have the following configuration:
  • PHP files: 644
  • Config files: 666
  • Other folders: 755  

DELETE LEFTOVER FILES

When you installed an extension that you didn't like, don't set the extension to unpublished. If you do, the vulnerable files will still be on your website. So simply use the un-install function to totally get rid of the extension. 

CHANGE YOUR .HTACCESS FILE

Add the following lines to your .htaccess file to block out some common exploits.
########## Begin - Rewrite rules to block out some common exploits
#
# Block out any script trying to set a mosConfig value through the URL
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|%3D) [OR]
# Block out any script trying to base64_encode crap to send via URL
RewriteCond %{QUERY_STRING} base64_encode.*(.*) [OR]
# Block out any script that includes a < script> tag in URL
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
# Block out any script trying to set a PHP GLOBALS variable via URL
RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2}) [OR]
# Block out any script trying to modify a _REQUEST variable via URL
RewriteCond %{QUERY_STRING} _REQUEST(=|[|%[0-9A-Z]{0,2}) [OR]
# Block out any script that tries to set CONFIG_EXT (com_extcal2 issue)
RewriteCond %{QUERY_STRING} CONFIG_EXT([|%20|%5B).*= [NC,OR]
# Block out any script that tries to set sbp or sb_authorname via URL
RewriteCond %{QUERY_STRING} sbp(=|%20|%3D) [OR]
RewriteCond %{QUERY_STRING} sb_authorname(=|%20|%3D)
# Send all blocked request to homepage with 403 Forbidden error!
RewriteRule ^(.*)$ index.php [F,L]
#
########## End - Rewrite rules to block out some common exploits
  

For more Joomla! security tips, you can read the following:
  

Subscribe Now

10,000 successful online businessmen like to have our content directly delivered to their inbox. Subscribe to our newsletter!

Archive Calendar

SatSunMonTueWedThuFri
 1
2345678
9101112131415
16171819202122
23242526272829
3031 

Over 20000 Satisfied Customers!

  • web hosting reviewer
    Valerie Quinn
    CTO, Acteon Group

    Centriohost staff were fantastic, I had a concern with a domain and they got back to me very quickly and they helped me to resolve the issue! ~ . . . Read more

  • Joomla hosting reviewer
    Collin Bryan
    Photographer, Allister Freeman

    I'm using centrio for my portfolio since 2006. The transition was seamless, the support was immediate, and everything works perfectly. ~ . . . Read more

  • dedicated server reviewer
    Harry Collett
    Actor, A&J Artists

    Very easy to understand & use even though I am not very technologically minded. No complications whatsoever & I wouldn't hesitate to recommend it to all. ~ . . . Read more

  • vps web hosting reviewer
    Porfirio Santos
    Technician, Diageo PLC

    Centrio support team have been amazingly responsive and helpful to any of my queries, thank you so much to the Centriohost have been amazingly responsive and helpful to any of my queries 👍👍👍 ~ . . . Read more

  • wordpress hosting plans reviewer
    Catherine Auer
    Doctor, SmartClinics

    Anytime I've had a problem I can't solve, I've found Centriohost to be diligent and persistent. They simply won't let an issue go until the client is happy. ~ . . . Read more

  • reseller hosting reviewer
    Effectivo Social
    Freelancer, Fiverr

    Recommend their shared hosting for all my SME web design clients. Their cloud or VME offerings are too great to deal with. Pricing is perfect and suitable for all users (͠≖ ͜ʖ͠≖) 👌 ~ . . . Read more

Top