comprar viagra online
comprar viagra generico barato
comprar cialis generico online
comprar cialis online seguro
7 tips to optimize Joomla! security |
Last April Fools I made a joke that my website was hacked and turned upside down. When your website is really hacked, there's nothing funny about it. Joomla! is a great CMS that is used worldwide. For this reason, hackers often try to find a way to hack a Joomla! website. Here are 7 tips to optimize your Joomla! security, preventing your Joomla! website getting hacked. Always remember to make a regular backup of your website and database. If you still get hacked, you can always get back to an older version of your website. Make sure you find out which extension caused the vulnerability and un-install it. Change the default database prefix (jos_)Most SQL injections that are written to hack a Joomla! website, try to retrieve data from the jos_users table. This way, they can retrieve the username and password from the super administrator of the website. Changing the default prefix into something random, will prevent (most / all) SQL injections. You can set the database prefix when installing your Joomla! website. If you've already installed Joomla! and want to change your prefix, do the following:
Remove version number / name of extensionsMost vulnerabilities only occur in a specific release of a specific extension. Showing MyExtension version 2.14 is a really bad thing. You can modify this message to only the name of the extension by doing the following:
Use a SEF componentMost hackers use the Google inurl: command to search for a vulnerable exploit. Use Artio, SH404SEF or another SEF component to re-write your URL's and prevent hackers from finding the exploits. Additionally, you'll get a higher rank in Google when using search engine friendly URL's. Keep Joomla! and extensions up to dateThis one is pretty obvious. Always check for the latest versions of Joomla! and the extensions you're using. Many vulnerabilities are resolved most of the times in later versions. Use the correct CHMOD for each folder and fileSetting files or folders to a CHMOD of 777 or 707 is only necessary when a script needs to write to that file or directory. All other files should have the following configuration:
Delete leftover filesWhen you installed an extension that you didn't like, don't set the extension to unbublished. If you do, the vulnerable files will still be on your website. So simply use the un-install function to totally get rid of the extension. Change your .htaccess fileAdd the following lines to your .htaccess file to block out some common exploits. ########## Begin - Rewrite rules to block out some common exploits # # Block out any script trying to set a mosConfig value through the URL RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|%3D) [OR] # Block out any script trying to base64_encode crap to send via URL RewriteCond %{QUERY_STRING} base64_encode.*(.*) [OR] # Block out any script that includes a < script> tag in URL RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR] # Block out any script trying to set a PHP GLOBALS variable via URL RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2}) [OR] # Block out any script trying to modify a _REQUEST variable via URL RewriteCond %{QUERY_STRING} _REQUEST(=|[|%[0-9A-Z]{0,2}) [OR] # Block out any script that tries to set CONFIG_EXT (com_extcal2 issue) RewriteCond %{QUERY_STRING} CONFIG_EXT([|%20|%5B).*= [NC,OR] # Block out any script that tries to set sbp or sb_authorname via URL (simpleboard) RewriteCond %{QUERY_STRING} sbp(=|%20|%3D) [OR] RewriteCond %{QUERY_STRING} sb_authorname(=|%20|%3D) # Send all blocked request to homepage with 403 Forbidden error! RewriteRule ^(.*)$ index.php [F,L] # ########## End - Rewrite rules to block out some common exploits For more Joomla! security tips, you can read the following:
Keep an eye on websites listing Joomla! vulnerabilities: If you have more tips to enhance the security of Joomla!, I would really like to hear them. Tags: security hacked joomla tips Interested in this topic? You might enjoy another article I've written called |
< Prev | Next > |
---|
Search |
---|
Or try the sitemap |