Joomla! Documentation - User contributions [en]

User talk:Jzlcdh

2015-02-09T10:05:27Z

Jzlcdh: totally confused what this was about so blanking out

User:Jzlcdh

2015-02-09T10:03:41Z

Jzlcdh: Blanked the page

Backup Basics for a Joomla! Web Site

2014-08-26T12:23:38Z

Jzlcdh: 2FA lockout workaround added

{{merge|What are the best practices for site backups?}}

Always keep a recent backup of your site. There is more to backup than accidents. Accidents do happen, but there are many other reasons it helps to have your backup files handy before the need arises. The causes of data loss are many. Joomla sites can be compromised by malicious attackers if the site administrator has not paid attention to security, or in rare cases when hackers bypass the best security. Joomla is designed for teamwork, and even good editors can make an error to harm the site. There are many reasons website administrators need to revert the site back to a previous working state.

Practice both backup and restore. Nobody should wait for an emergency to test their skills and tools for dealing with an emergency. Very often people create a backup of something that is empty or corrupted, and discover that none of their critical data was really backed up in the first place. Nobody likes a ship that sinks with empty lifeboats, and it's also wise to practice getting people out of the lifeboats and into a new working system. Having a backup is not just about accidents, because a person well versed in backup can help with safe development of new features. Backup and restore help web managers create a staging website where new changes can be practiced without risking the production website. The clone can be created on a local machine acting as a test server, or any other folder or web hosting account supporting the SQL and PHP versions used by the site you've backed up. It's easy for anyone to mix up their live site and staging site, so change the color of your staging site template to remind developers that the staging site is not live to the public.

If you use 2 factor authentication then currently (written Aug 2014) if you are locked out of your site you can rename the folder plugins/twofactorauth to twofactorauth.BAK and log in to your site's back-end. Then disable all plugins under the "twofactorauth" group. Finally, rename the plugins/twofactorauth.BAK folder of your site back to twofactorauth.

== Summary ==

There are two parts to a complete back up of your Joomla site

a) The database information, most often found in your mysql database

b) The files and folders on your website, as hosted on most static html websites

== Database Backup Part 1 of 2 ==

One of the first steps to backup your Joomla site is to close the site to the public, backup the files, and then re-open the site. The steps from phpmyadmin.net omit this much needed operation. Go to the backend of your Joomla control panel, under global configuration, under the site tab, set "site offline" = yes. This will then change the look of your configuration.php file in the root of your Joomla website. An administrator will need to use your hosting control panel to view that file or use FTP to download and view the file. Inside configuration.php you can find the name of your database that will need backing up. Look for the line with code resembling "var $db = 'x1234';" or "public $db = 'x1234';" Where x1234 is the name of your database.

Using the logon information for your server or hosting company open the PhpMyAdmin tool. Open the database and look for the table named "users" and then click the icon to "view" the data in that table. You should see the names of staff who have accounts on your Joomla site. This view provides you the confidence that you are about to backup the correct database. Click the export tab, then go. Your browser will download your database into an SQL file. Find where you browser put that file, then move the file to a much more secure drive or location.

Server SQL databases can be backed up without PhpMyAdmin and instead using the SQL command line. If you know how to do that, you're most likely not in need of this documentation.

It is recommended to back up the database at least twice per week or even everyday (and more) if you have an active site.

== File System Backup Part 2 of 2 ==

Continue with your site offline, see above. Your joomla folder and files can be backed up by downloading them with an FTP utility or using the file manager of your webhosting company. Both of these file options work, neither is better.

FTP tools move thousands of Joomla files and use more time. The FTP process can be slow and interrupted. Many Joomla sites are hosted by providers like godaddy or hostgator who provide a control panel for taking thousands of files in one folder and then creating a zip file very quickly. This means your site is offline for a shorter amount of time, and you have only one zip file. Go to your hosting control panel and look for their file manager icon.

If you use your hosting file manager, practice using that interface to select your server folder and creating a zip file. Download the zip file locally and then expand it locally to to see what files are inside that zip file. This option also let's you expand the same zip file for restoration to a staging site.

Backing up the Joomla files with FTP is no different than backing up a static HTML website. Download all the files and folders that exist in the main Joomla directory. The downloaded locaiton is a folder on your local computer. Be sure that the file and directory structure remains the same as it is in the live site. When you restore the files, you will use the FTP utility to upload the files to a new server.

'''As soon as you've downloaded your files via zip or FTP, change your site to be online.
'''

== More Backup Documentation ==

Most administrators of a Joomla website have access to their MySQL data using the GUI interface called PhpMyAdmin, see [https://phpmyadmin.readthedocs.org/en/latest/faq.html#how-can-i-backup-my-database-or-table How can I backup my database or table?] for more information.

There are several automated backup extensions for Joomla! located in the [http://extensions.joomla.org Joomla! Extensions Directory]. Here is a link for [http://extensions.joomla.org/extensions/access-a-security/site-security/backup Joomla! Backup Extensions].

When servers are hosted in the same building as the staff, the web administrators should make extra care to store the backup copies of the database/files in a different building. Fire, theft, water or other damage often wipes out the live website AND backups. On a regular basis the web administrators should burn both the database and files to CD or save to an external hard drive off site.

==Special Notes==
=== Automated Backup Tools ===

==== Akeeba ====

* Akeeba Backup produces a .jpa file that you should download to a safe location that's not on your webhost or webserver.

* The .jpa file contains all the folders/files and database files.

* The .jpa file also contains an installer

These paragraphs are about backup, but it's worth a quick note that the Akeeba restore process is a fast guided process similar to a setup wizard. Place 2 files on a new webhost. a) your JPA file and b) Kickstart.php (from Akeeba) You then use a browser to launch the restore process and unpack the .jpa file. Please read the Akeeba restore documentation.

Akeeba and other backup extensions can be download from [http://extensions.joomla.org/extensions/access-a-security/site-security/backup]

[[Category:Tutorials]][[Category:Security]]

Security Checklist/Site Administration

2014-08-26T12:20:49Z

Jzlcdh: /* Consider using 2 factor authentication */

{{:Security Checklist/TOC}}
== Site Administration ==

===Use well-formed passwords===
: Change passwords regularly and keep them unique. A strong password has a random combination of letters, numbers, or symbols. Avoid using single names or words found in a dictionary. Never use the names of your relatives, pets, etc. Search the forums for a script supplied by Wizzie that automatically changes passwords. This is a great tool for administrators or multiple sites. There are numerous handy websites that have [http://strongpasswordgenerator.com strong password generators].

===Consider using 2 factor authentication===
: For superusers (and perhaps other powerful users) consider using 2 factor authentication. {{JVer/multi|3.2}}

If you set all superusers on your live site to use 2FA then currently (written Aug 2014) if you are locked out of your site after recovery you can rename the folder plugins/twofactorauth to twofactorauth.BAK and log in to your site's back-end. Then disable all plugins under the "twofactorauth" group. Finally, rename the plugins/twofactorauth.BAK folder of your site back to twofactorauth.

===Maintain a strong site backup process===
: Never rely on others' backups. Take responsibility for your backup procedures. Many ISPs state in their contract that you cannot rely solely on their backups.

===Monitor crack attempts===
: VPS and dedicated server users can run [http://www.tripwire.com/ TripWire] or [http://la-samhna.de/samhain/ SAMHAIN]. These applications provide exhaustive file checking and reporting functionality, and can be installed in a stealthy manner to help protect themselves in the event of a serious infiltration. (Note: Users of shared servers cannot use this technique.)</li>

===Perform automated intrusion detection===
: Use an Intrusion Prevention/Detection Systems to block/alert on malicious HTTP requests.
* [http://www.google.com/search?q=Intrusion+Prevention Google search]

===Perform manual intrusion detection===
: Regularly check raw logs for suspicious activity. Don't rely on summaries and graphs.

===Stay current with security patches and upgrades===
: Apply vendor-released security patches ASAP.
* Review the [http://docs.joomla.org/Vulnerable_Extensions_List vulnerable extensions]

===Proactively seek site vulnerabilities===
: Perform frequent web scanning.

* [http://www.google.com/search?q=%22web+scanning Google Search]

===Proactively seek SQL injections vulnerabilities===
: Use tools such as [http://www.parosproxy.org/ Paros Proxy] for conducting automated SQL Injection tests against your PHP applications.
<ul>
<li>[http://www.google.com/search?q=%22SQL+Injection Google Search]</li>
<li>[http://en.wikipedia.org/wiki/SQL_injection Wikipedia Article]</li>
</ul>

===Use shell scripts to automate security tasks===
: Search the forums for these popular scripts:
<ul>
<li>Joomla! Version Checking</li>
<li>Joomla! Component/Module Version Checking</li>
<li>Exploit Checking</li>
</ul>

===Learn about security software===
: There is not a single tool that can protect your site. If there were, it would be so heavily targeted that it would probably become a liability.

===Don't reinvent every wheel===
: Every now and then, hire a professional Joomla! security consultant to review your configurations. Do you remember the adage, ''"Anyone who acts as their own lawyer has a fool for a client."?'' The same goes for Web development. Don't expect to catch all of your own security mistakes.


[[Category:Security Checklist]]

Backup Basics for a Joomla! Web Site

2014-08-19T07:06:56Z

Jzlcdh: added 2fa note

{{merge|What are the best practices for site backups?}}

Always keep a recent backup of your site. There is more to backup than accidents. Accidents do happen, but there are many other reasons it helps to have your backup files handy before the need arises. The causes of data loss are many. Joomla sites can be compromised by malicious attackers if the site administrator has not paid attention to security, or in rare cases when hackers bypass the best security. Joomla is designed for teamwork, and even good editors can make an error to harm the site. There are many reasons website administrators need to revert the site back to a previous working state.

Practice both backup and restore (Note: if you use 2 factor authentication then currently - written Aug 2014 - you need to read http://github.com/joomla/joomla-cms/issues/4126#issuecomment-52558665). Nobody should wait for an emergency to test their skills and tools for dealing with an emergency. Very often people create a backup of something that is empty or corrupted, and discover that none of their critical data was really backed up in the first place. Nobody likes a ship that sinks with empty lifeboats, and it's also wise to practice getting people out of the lifeboats and into a new working system. Having a backup is not just about accidents, because a person well versed in backup can help with safe development of new features. Backup and restore help web managers create a staging website where new changes can be practiced without risking the production website. The clone can be created on a local machine acting as a test server, or any other folder or web hosting account supporting the SQL and PHP versions used by the site you've backed up. It's easy for anyone to mix up their live site and staging site, so change the color of your staging site template to remind developers that the staging site is not live to the public.

== Summary ==

There are two parts to a complete back up of your Joomla site

a) The database information, most often found in your mysql database

b) The files and folders on your website, as hosted on most static html websites

== Database Backup Part 1 of 2 ==

One of the first steps to backup your Joomla site is to close the site to the public, backup the files, and then re-open the site. The steps from phpmyadmin.net omit this much needed operation. Go to the backend of your Joomla control panel, under global configuration, under the site tab, set "site offline" = yes. This will then change the look of your configuration.php file in the root of your Joomla website. An administrator will need to use your hosting control panel to view that file or use FTP to download and view the file. Inside configuration.php you can find the name of your database that will need backing up. Look for the line with code resembling "var $db = 'x1234';" or "public $db = 'x1234';" Where x1234 is the name of your database.

Using the logon information for your server or hosting company open the PhpMyAdmin tool. Open the database and look for the table named "users" and then click the icon to "view" the data in that table. You should see the names of staff who have accounts on your Joomla site. This view provides you the confidence that you are about to backup the correct database. Click the export tab, then go. Your browser will download your database into an SQL file. Find where you browser put that file, then move the file to a much more secure drive or location.

Server SQL databases can be backed up without PhpMyAdmin and instead using the SQL command line. If you know how to do that, you're most likely not in need of this documentation.

It is recommended to back up the database at least twice per week or even everyday (and more) if you have an active site.

== File System Backup Part 2 of 2 ==

Continue with your site offline, see above. Your joomla folder and files can be backed up by downloading them with an FTP utility or using the file manager of your webhosting company. Both of these file options work, neither is better.

FTP tools move thousands of Joomla files and use more time. The FTP process can be slow and interrupted. Many Joomla sites are hosted by providers like godaddy or hostgator who provide a control panel for taking thousands of files in one folder and then creating a zip file very quickly. This means your site is offline for a shorter amount of time, and you have only one zip file. Go to your hosting control panel and look for their file manager icon.

If you use your hosting file manager, practice using that interface to select your server folder and creating a zip file. Download the zip file locally and then expand it locally to to see what files are inside that zip file. This option also let's you expand the same zip file for restoration to a staging site.

Backing up the Joomla files with FTP is no different than backing up a static HTML website. Download all the files and folders that exist in the main Joomla directory. The downloaded locaiton is a folder on your local computer. Be sure that the file and directory structure remains the same as it is in the live site. When you restore the files, you will use the FTP utility to upload the files to a new server.

'''As soon as you've downloaded your files via zip or FTP, change your site to be online.
'''

== More Backup Documentation ==

Most administrators of a Joomla website have access to their MySQL data using the GUI interface called PhpMyAdmin, see [https://phpmyadmin.readthedocs.org/en/latest/faq.html#how-can-i-backup-my-database-or-table How can I backup my database or table?] for more information.

There are several automated backup extensions for Joomla! located in the [http://extensions.joomla.org Joomla! Extensions Directory]. Here is a link for [http://extensions.joomla.org/extensions/access-a-security/site-security/backup Joomla! Backup Extensions].

When servers are hosted in the same building as the staff, the web administrators should make extra care to store the backup copies of the database/files in a different building. Fire, theft, water or other damage often wipes out the live website AND backups. On a regular basis the web administrators should burn both the database and files to CD or save to an external hard drive off site.

==Special Notes==
=== Automated Backup Tools ===

==== Akeeba ====

* Akeeba Backup produces a .jpa file that you should download to a safe location that's not on your webhost or webserver.

* The .jpa file contains all the folders/files and database files.

* The .jpa file also contains an installer

These paragraphs are about backup, but it's worth a quick note that the Akeeba restore process is a fast guided process similar to a setup wizard. Place 2 files on a new webhost. a) your JPA file and b) Kickstart.php (from Akeeba) You then use a browser to launch the restore process and unpack the .jpa file. Please read the Akeeba restore documentation.

Akeeba and other backup extensions can be download from [http://extensions.joomla.org/extensions/access-a-security/site-security/backup]

[[Category:Tutorials]][[Category:Security]]

Security Checklist/Site Administration

2014-08-19T06:48:59Z

Jzlcdh: /* Consider using 2 factor authentication */ added link re secret key issue

{{:Security Checklist/TOC}}
== Site Administration ==

===Use well-formed passwords===
: Change passwords regularly and keep them unique. A strong password has a random combination of letters, numbers, or symbols. Avoid using single names or words found in a dictionary. Never use the names of your relatives, pets, etc. Search the forums for a script supplied by Wizzie that automatically changes passwords. This is a great tool for administrators or multiple sites. There are numerous handy websites that have [http://strongpasswordgenerator.com strong password generators].

===Consider using 2 factor authentication===
: For superusers (and perhaps other powerful users) consider using 2 factor authentication. {{JVer/multi|3.2}}

If you set all superusers on your live site to use 2FA then currently (written Aug 2014) you will need to read
http://github.com/joomla/joomla-cms/issues/4126#issuecomment-52558665
when doing your disaster recovery test.

===Maintain a strong site backup process===
: Never rely on others' backups. Take responsibility for your backup procedures. Many ISPs state in their contract that you cannot rely solely on their backups.

===Monitor crack attempts===
: VPS and dedicated server users can run [http://www.tripwire.com/ TripWire] or [http://la-samhna.de/samhain/ SAMHAIN]. These applications provide exhaustive file checking and reporting functionality, and can be installed in a stealthy manner to help protect themselves in the event of a serious infiltration. (Note: Users of shared servers cannot use this technique.)</li>

===Perform automated intrusion detection===
: Use an Intrusion Prevention/Detection Systems to block/alert on malicious HTTP requests.
* [http://www.google.com/search?q=Intrusion+Prevention Google search]

===Perform manual intrusion detection===
: Regularly check raw logs for suspicious activity. Don't rely on summaries and graphs.

===Stay current with security patches and upgrades===
: Apply vendor-released security patches ASAP.
* Review the [http://docs.joomla.org/Vulnerable_Extensions_List vulnerable extensions]

===Proactively seek site vulnerabilities===
: Perform frequent web scanning.

* [http://www.google.com/search?q=%22web+scanning Google Search]

===Proactively seek SQL injections vulnerabilities===
: Use tools such as [http://www.parosproxy.org/ Paros Proxy] for conducting automated SQL Injection tests against your PHP applications.
<ul>
<li>[http://www.google.com/search?q=%22SQL+Injection Google Search]</li>
<li>[http://en.wikipedia.org/wiki/SQL_injection Wikipedia Article]</li>
</ul>

===Use shell scripts to automate security tasks===
: Search the forums for these popular scripts:
<ul>
<li>Joomla! Version Checking</li>
<li>Joomla! Component/Module Version Checking</li>
<li>Exploit Checking</li>
</ul>

===Learn about security software===
: There is not a single tool that can protect your site. If there were, it would be so heavily targeted that it would probably become a liability.

===Don't reinvent every wheel===
: Every now and then, hire a professional Joomla! security consultant to review your configurations. Do you remember the adage, ''"Anyone who acts as their own lawyer has a fool for a client."?'' The same goes for Web development. Don't expect to catch all of your own security mistakes.


[[Category:Security Checklist]]

Security Checklist/Site Administration

2014-03-17T09:16:43Z

Jzlcdh: added 2 factor auth

{{:Security Checklist/TOC}}
== Site Administration ==

===Use well-formed passwords===
: Change passwords regularly and keep them unique. A strong password has a random combination of letters, numbers, or symbols. Avoid using single names or words found in a dictionary. Never use the names of your relatives, pets, etc. Search the forums for a script supplied by Wizzie that automatically changes passwords. This is a great tool for administrators or multiple sites. There are numerous handy websites that have [http://strongpasswordgenerator.com strong password generators].

===Consider using 2 factor authentication===
: For superusers (and perhaps other powerful users) consider using 2 factor authentication. {{JVer/multi|3.2}}

===Maintain a strong site backup process===
: Never rely on others' backups. Take responsibility for your backup procedures. Many ISPs state in their contract that you cannot rely solely on their backups.

===Monitor crack attempts===
: VPS and dedicated server users can run [http://www.tripwire.com/ TripWire] or [http://la-samhna.de/samhain/ SAMHAIN]. These applications provide exhaustive file checking and reporting functionality, and can be installed in a stealthy manner to help protect themselves in the event of a serious infiltration. (Note: Users of shared servers cannot use this technique.)</li>

===Perform automated intrusion detection===
: Use an Intrusion Prevention/Detection Systems to block/alert on malicious HTTP requests.
* [http://www.google.com/search?q=Intrusion+Prevention Google search]

===Perform manual intrusion detection===
: Regularly check raw logs for suspicious activity. Don't rely on summaries and graphs.

===Stay current with security patches and upgrades===
: Apply vendor-released security patches ASAP.
* Review the [http://docs.joomla.org/Vulnerable_Extensions_List vulnerable extensions]

===Proactively seek site vulnerabilities===
: Perform frequent web scanning.

* [http://www.google.com/search?q=%22web+scanning Google Search]

===Proactively seek SQL injections vulnerabilities===
: Use tools such as [http://www.parosproxy.org/ Paros Proxy] for conducting automated SQL Injection tests against your PHP applications.
<ul>
<li>[http://www.google.com/search?q=%22SQL+Injection Google Search]</li>
<li>[http://en.wikipedia.org/wiki/SQL_injection Wikipedia Article]</li>
</ul>

===Use shell scripts to automate security tasks===
: Search the forums for these popular scripts:
<ul>
<li>Joomla! Version Checking</li>
<li>Joomla! Component/Module Version Checking</li>
<li>Exploit Checking</li>
</ul>

===Learn about security software===
: There is not a single tool that can protect your site. If there were, it would be so heavily targeted that it would probably become a liability.

===Don't reinvent every wheel===
: Every now and then, hire a professional Joomla! security consultant to review your configurations. Do you remember the adage, ''"Anyone who acts as their own lawyer has a fool for a client."?'' The same goes for Web development. Don't expect to catch all of your own security mistakes.


[[Category:Security Checklist]]

Security Checklist/Getting Started

2014-03-14T14:34:55Z

Jzlcdh: /* The most important guidelines */ updated forums

{{:Security Checklist/TOC}}
=== Security matters ===

:Internet security is a fast moving challenge and ever present threat. There is no one right way to secure a website, and all security methods are subject to instant obsolescence, incremental improvement, and constant revision. All public facing websites are open to constant attack. Are you willing and able to invest the time it takes to administer a dynamic, 24x7, world-accessible, database-driven, interactive, user-authenticated website? Do you have the time and resources to respond to the constant flow of new Internet security issues? The [[Top 10 Stupidest Administrator Tricks]] is a comic/tragic look at what can go wrong. Don't learn these tricks the hard way! Depending on your own experience, reading the ''Stupidest Tricks'' will either make you laugh or cry. Luckily, there are some well-established principles upon which to base your defensive plans. The following checklists point you toward current best practices for Joomla security.

=== How to read these documents ===
#Not all techniques are appropriate for every level of experience. Apply the techniques you understand and read up on the ones you don't.
#Not all techniques are appropriate for every server. If you use a shared server, you must depend on the settings established by your hosting provider. If you are using a virtual or dedicated server, you can apply more creative security tactics.
#Not all security tactics are appropriate for all versions of Joomla. Where a technique applies to only one version it is noted by one of the following icons: {{JVer/multi|1.0,1.5,1.6,1.7,2.5,3.0,3.1}}

=== The most important guidelines===
:These checklists are long and growing because the full plot is thick, complex, and expanding, but don't despair! Here are a few essential guidelines for securing any website. Following them will protect you from most catastrophes.

# '''Back up early and often:''' Set up (and use and test) a regular backup and recovery process. When done well, this ensures that you can recover from almost any imaginable disaster.
# '''Update early and often:''' Promptly update to the latest ''stable'' version of Joomla! and any installed third-party extensions. This ensures that your site is protected from the newest vulnerabilities as soon as a fix is released and from the latest attack methods as soon as a defense is developed.
# '''Use a secure host''': Use a high-quality Web host. Do not be fooled by offers of 'unlimited bandwidth, unlimited hard drive space, unlimited databases, etc.
# '''Use the community''': Don't forget the truism, "If a deal is too good to be true, it is." It seems that nothing on Earth is unlimited--except perhaps the gullibility of fools and the greed of those who prey upon them. Consider hiring professional assistance if you have inadequate experience or knowledge in this area. One of the advantages of GNU software is that user support is free. Take good advantage of this by asking good questions within the [http://forum.joomla.org Joomla! Forums]. When doing so, be sure to use the the most appropriate board, such as Installation, Migration and Updating, Administration.

::The most helpful posts in the Joomla! Security Forum are converted into [[Security and Performance FAQs]]. Many of the items on this list are explained in much greater detail in the FAQs.

::You may want to read the excellent [[Beginners|Absolute Beginners Guide to Joomla!]] It has wealth of tips and tricks presented in an easy to understand format. Even experienced Joomlaists find great ideas here.

::Hunt down the many nuggets of wisdom found in the [http://forum.joomla.org Joomla! Forums], in particular the [http://forum.joomla.org/viewforum.php?f=714 Joomla! 3.x Security Forum] and the [http://forum.joomla.org/viewforum.php?f=621 Joomla! 2.x Security Forum].

::To receive all Joomla security announcements, subscribe to Joomla Security News. There are several ways to subscribe:

::# [http://feedburner.google.com/fb/a/mailverify?uri=JoomlaSecurityNews Automatic Email Notification]
::# [http://feeds.joomla.org/JoomlaSecurityNews RSS feed].

=== The bad news ===
#'''There is no perfect security on the Web!''' As economists would say, "There's no free lunch." Don't be fooled by Joomla's award winning ease-of-use. Maintaining a secure Web site on the open Internet is not easy. Maintaining adequate security requires a wide and ever-growing range of skills and knowledge, constant watchfulness, and a robust backup and recovery process.
#'''There's no one right way!''' Due to the variety and complexity of modern web systems, security issues can't be resolved with simple, one-size-fits-all solutions. You (or someone you trust) must learn enough about your server infrastructure to make valid security decisions. Strong security is a moving target. Today's expert might be tomorrow's victim. Welcome to the game...
#'''There's no substitute for experience!''' To secure your Web site, you must gain real experience (some of which will be bitter), or get experienced help from others. If you haven't invested the considerable time it takes to learn how to maintain a secure Web site, be sure you can consult with someone who has. Read this tongue-in-cheek description of the [[Top_10_Stupidest_Administrator_Tricks|Top 10 Stupidest Administrator Tricks]] which illustrates typical, blow-by-blow examples of how to learn Web security the hard way.

=== The good news ===

#'''Even a beginner can start at the head of the herd''' User forums for many systems are clogged with [http://www.google.com/search?q=Help!+I've+been+hacked Help! I've been hacked] posts by people who did NOT follow standard security practices. If you are studying this checklist before your site is attacked, congratulations, you're already ahead of the herd.
#'''It's not as hard as it looks''' If this is one of your first websites, security issues may seem overwhelming, but you don't have to deal with all of them at once. Start with the most critical issues. As you become more familiar with [http://www.gnu.org GNU] tools and techniques, including [http://www.gnu.org/ GNU/Linux], [http://www.apache.org Apache], [http://www.mysql.com MySQL], [http://en.wikipedia.org/wiki/SQL SQL], [http://www.php.net PHP], [http://en.wikipedia.org/wiki/HTTP HTTP], [http://en.wikipedia.org/wiki/CSS CSS], [http://en.wikipedia.org/wiki/XML XML], [http://en.wikipedia.org/wiki/RSS RSS], [http://en.wikipedia.org/wiki/TCP/IP TCP/IP], [http://en.wikipedia.org/wiki/FTP FTP], [http://subversion.tigris.org/ Subversion], [http://en.wikipedia.org/wiki/JavaScript JavaScript], and [http://www.joomla.org Joomla!], you'll add refinements to your set of security tactics.
#'''You can get help''' If you believe your website was attacked, '''do not''' simply post an announcement with full details in the Joomla! forums. If you are dealing with a new vulnerability or new form of attack, publishing that information could put other websites at risk. Instead, report possible security vulnerabilities to the [http://developer.joomla.org/security Joomla! Security Task Force].


[[Category:Security Checklist]]

Security Checklist/Joomla! Setup

2014-03-14T13:34:48Z

Jzlcdh: /* Protect directories and files */ removed advice to move config file as according to docs not good advice nowadays

{{:Security Checklist/TOC}}
== Configuring Joomla!==

===Install official versions of Joomla!===
: To avoid breaking your site, search the forums for reports of incompatible extensions before upgrading to a new version of Joomla.

: Upgrade to the [http://www.joomla.org/download.html latest stable version of Joomla!] as soon as possible.

: Download Joomla! from official sites only, such as [http://joomlacode.org/ JoomlaCode.org], and check the [http://docs.joomla.org/How_to_determine_a_package_checksum MD5 hash].

: Use [http://extensions.joomla.org/component/option,com_mtree/task,viewlink/link_id,1146/Itemid,35/ Joomla Diagnostics] to ensure that all files were installed correctly. (Note: the version of Joomla Diagnostics made for the initial release of 1.5 does not work for 1.5.3.)

Note to editors: This extension has been unpublished for the following reason: UR8-Copyright Violations

===Change the default administrator username===
: Change the user name of the default admin user. This simple step effectively increases the security of this critical account 50% by modifying one of the two variables attackers must know to gain access. The password is the other variable. Change it early and often. '''([[Security_and_Performance_FAQs#Why_should_I_immediately_change_the_name_of_the_default_admin_user_after_a_new_install.3F|FAQ]])'''

===Protect directories and files===
: Ensure that all configurable paths to writable or uploadable directories (document repositories, image galleries, caches) are outside of public_html. Check third party extensions such as DOCMan and Gallery2 for editable paths to writable directories.

: {{JVer|1.5}}{{JVer|2.5}}{{JVer|3.x}} In the Back-End Global Configuration, change the log path. Some extensions use the built in JLog class. This will, by default write logs to http://yousite/logs. Change this to a place that a casual browser cannot find (and don't pick /tmp/), or lock it down with http authentication. Because we are dealing with Open Source software, attackers can read the code of third-party extensions and may be able to guess log file names.

: {{JVer|1.5}}{{JVer|2.5}}{{JVer|3.x}} In the Back-End Global Configuration, change the temp folder path.

: If the log and temp paths are changed and PHP ''open_basedir'' configuration directive is set, make sure that the new paths fall within the scope of ''open_basedir''.

: There is currently no easy way to move the Joomla! /image and /media directories. This is because thousands of third party extensions expect to find these important directories at the current location. The best plan is to make sure open_basedir is properly set for all the user accounts on your server. Check with your host if unsure.

===Adjust file and directory permissions===
'''This option no longer appears in Joomla.'''
On Older versions of Joomla : Once your site is configured and stable, write-protect critical directories and files by changing directory permissions to 755, and file permissions to 644. There is a feature in Site --> Global Configuration --> Server to set all folder and file permissions at once. Test third party extensions afterwards, and carefully review the code of any extension that has trouble with such settings. Note: Depending on your server's permissions, you may need to temporarily reset to more open permissions when installing more extensions with the Joomla! installer.
'''This option no longer appears in Joomla.''' but is included for historical purposes.

===Remove unneeded files ===
: Remove all design templates not needed by your site. Never put security logic into template files.

: {{JVer|1.5}} Disable the XML-RPC server if you don't need it.

: Clean up after installs. The installation process will require you to delete the installation directory and all its contents. Do this; do not simply rename it. If you upload files to your site as compressed archives (xxxx.zip for example), don't forget to remove the compressed file. Check the /temp/ directory as temporary files may remain there after a failed installation attempt.

: In general, do not leave any unneeded files (compressed or otherwise) on a public server. Each unused (and perhaps long forgotten) file is a potential security hole.

===Turn Register Globals Emulation OFF===

: {{JVer|1.0}} Turn Joomla's Register Globals Emulation OFF. Although this setting is somewhat safer than PHP register_globals, you are much better off avoiding such settings all together (as well as any applications that require them). On pre-1.0.13 versions of Joomla, this setting is found in the globals.php file. As of version 1.0.13, it can be turned off in the Back-end, under Global Settings.

: {{JVer|1.5}}{{JVer|2.5}}{{JVer|3.x}} Joomla 1.5 and greater, does not use register globals, and in fact has smart code to defeat this setting even if it's turned on at the PHP level. Note that although this makes Joomla itself safer, any server with register globals turned on is potentially vulnerable. Any shared server with register globals turned on is more than likely a sitting duck. Any hosting provider that insists register globals should be turned on is ignorant, incompetent, or worse. Was that blunt enough?

: For more information on register_globals, please see [[Security_Checklist_2_-_Hosting_and_Server_Setup#Don.27t_use_PHP_register_globals|Security Checklist: PHP: register_globals]].

== Installing Joomla! Extensions ==

===Backup before installing ===
: Before installing extensions, always backup your site's files and database. This follows a very basic principle:

: '''''Thou shalt at all times be able to return your site to a previous working state.'''''

: Therefore, it's smart to set up a simple and fast backup script to automate this task. If you don't set up an easy process in advance, you'll be sorely tempted to do a quick upgrade without backing up first. This very understandable tendency is however one of the chief causes of premature hair loss, sudden career changes, and even death.

===Check for extension vulnerabilities===
: Most security vulnerabilities are caused by third party extensions. Before installing extensions, check the Official List of Vulnerable 3rd Party/Non Joomla! Extensions. There's an entire forum dedicated to vulnerable third part extensions. Subscribe to it.

===Download from trusted sites===
: The fully qualified and official definition of a "trusted site" is one that '''YOU''' trust.

===User beware! Check the code quality===
: Third party extensions come in all flavors of quality and age. Although Joomla! coding standards exist, third party developers are not required to follow them. Extensions listed on the official Joomla! site are not reviewed for compliance, however if verified vulnerabilities are reported, they will be removed from the list until they are fixed.

===Test, test, test...===
: Test all extensions on a development site before installing on a production site. Then test on the production site. Don't forget to check the logs for runtime errors and warnings.

===Remove junk files===
: Remove all unused extensions and double check that related folders and files were actually removed by uninstall scripts. Note that during uninstall, many third party extensions will leave related files on your site, and related database tables complete with data. This is either a feature or a bug depending on your point of view. Any files left on your server remain accessible from the Web via direct URLs, such as http://yousite.com/modules/bad_module.

===Avoid encrypted code===
: Joomla is (and despite disinformation campaigns, always has been) a GNU GPL project. This means that all extensions to Joomla must also be free (as in freedom) and open (as in readable code). Encrypted code may be safe, but you can't determine this for yourself, and so you must trust the developers. Using others' encrypted code puts you back in the world of proprietary software where you must wait for security patches from the developer, hoping that attackers don't find your site first before a fix is released.

: You are often not free to modify, improve, or share encrypted code. These restrictions make encrypted code less valuable to the community as a whole, and reduce the overall viability of the Joomla project which depends on open sharing among all participants.

: Of course, code that is not distributed to others is exempt from GNU GPL distribution requirements. Thus you can encrypt Joomla-related code on your own servers, providing you do not share it with others.

==Additional Joomla! Hardening Tips and Tricks ==

===Avoid shared servers if possible===
: For maximum security, avoid a shared server on which you don't know or can't trust all the other users or their code quality.

===Use an SSL server===
''This has more to do with secure payments and administration, and is not Joomla! core or server security, but has been included here for advisory purposes.
''
: SSL servers are currently the only way to securely process confidential transactions and secure user authentication. SSL works by encrypting all HTTP communications between the Web server and Web clients. Thus, even if a transmission is intercepted, it cannot be read.

: Joomla! 1.0.x does not allow you to assign an SSL server to individual sub-directories. Search the forums for "Tommy Hack" for one way to deal with this. Joomla! 1.5 has greatly improved SSL options.

===Use Apache's .htaccess===
: For an additional layer of password protection, you can use .htaccess to password protect critical directories. This is usually adequate for blocking the typical script kiddie, but be aware that .htaccess password protection alone is not a highly secure method. It MUST be combined with an SSL server for maximum protection. An SSL server is required for protecting your site from more sophisticated attacks, such as packet sniffing.

===Switch to Joomla! 1.5 or newer===
{{JVer|1.0}} The most significant upgrade in Joomla!'s history includes powerful security and performance enhancements.
* [http://www.joomla.org/content/view/4483/118/ Joomla 1.5 Overview]
* [http://joomlacode.org/gf/project/joomla/frs/?action=index Joomla Downloads]

=== Add Joomla! Security Announcements to your site ===
: The Joomla! Security Team supports and RSS feed that provides the latest Joomla security information. The following FAQ explains how to add this feed to your site.

* [http://docs.joomla.org/Security_and_Performance_FAQs#How_can_I_add_the_Joomla.21_Security_Announcements_Feed_to_the_Admin_Control_Panel.3F How can I add the Joomla! Security Announcements Feed to the Admin Control Panel?]


[[Category:Security Checklist]]

File:IPrestrictionIIS.jpg

2011-07-13T13:00:10Z

Jzlcdh: IIS 7.5 screenshot for IP restriction

IIS 7.5 screenshot for IP restriction

IIS

2011-07-13T12:58:22Z

Jzlcdh: /* Restricting access to the backend by IP address */

Whilst IIS (Internet Information Services, a Microsoft web server) accounts for relatively few users, compared to Apache, there are enough to warrant providing information which is unique.

PHP can run on IIS, so a Joomla! web site also can run on IIS.

The PHP.net website should be referenced, regarding the installation of PHP on Windows and the configuraiton of IIS to process PHP webpages and scripts.

To get started, here are some helpful links for developers who want to install PHP and Joomla! on IIS.

* Install Joomla for Windows and IIS using the Web Platform Installer - http://www.microsoft.com/web/joomla
* PHP on Windows and IIS; building an IIS-optimized PHP - http://www.microsoft.com/web/php

The two most common problems encountered by Joomla! admins whose sites are on IIS webservers are:
* Setting the website's directory/filesystem permissions correctly
* Enabling SEF URLs

==Setting the filesystem permissions==

===Conceptual Overview===
Windows filesystem permissions are more complex than the 3-level, 3-value Unix-style <code>rw-r--r--</code> conventions.

Windows servers have a user called <code>IUSR</code>, which corresponds to the <code>apache</code> user on many Linux systems. PHP scripts run under the IUSR account.

====Levels====
A directory or file does have an <code>owner</code>, and Windows does have <code>group</code>s, but there is no <code>"everyone else"</code> under Windows.

There is a group called <code>Users</code>. This corresponds to all accounts used by human beings to deliberately interact with the server. But accounts for services, system operations, and software user permisions do not belong to that group, and in fact '''no''' accounts at all (human or otherwise) have '''any''' privileges which aren't explicitly granted either directly to the user or by membership in some group.

====Values====
Beyond <code>Read</code>, <code>Write</code> and <code>Execute</code>, Windows permissions include additional values. The important ones to know about for a Joomla website are <code>Read</code> and <code>Write</code>.

===HowTo configure the permissions===
When logged in to the Windows server, run Windows Explorer, and navigate to inetpub.

Right-click the directory which holds your Joomla site. 
Get Properties, tab to Security. 
Click ADD. 
Make sure that the LOCATION field is set to the local computer, not a domain controller. 
Type iis_iusrs into the field for identifying the user/group you are granting access to. 
Confirm. 
Highlight the iis_iusrs entry in the access control list. 
Check the boxes for Read & Execute, List Folder Contents, Read, and Write 
Confirm, put the security window away now. 
Open Start -. Administrator -> Computer Management. 
Navigate to Local Users and Groups -> Groups. 
Find or create the group iis_iusrs 
Add a member to the group: 
again, make sure that the LOCATION field is set to the local computer, not a domain controller. 
Type IUSR into the field for identifying the user/group you are granting access to. 
Confirm. 
Save. 

Run the Joomla installer again, and enjoy your PHP user's write privileges in your website folder.

==[[Restricting access to the backend by IP address]]==

You can utilise server based IP protection.
If you're running IIS 7.5 on Windows Server 2008, you can use the IP and
Domain Security option. Go to the Server Manager MMC panel and select
"Roles" and then "Web Server (IIS). From here select "Add Role Services" and
in the window that pops up, scroll down to security and select the "IP And
Domain Security Option" (see screenshot below)
[[File:IPrestrictionIIS.jpg]]
and then hit next to install.
Once you've got it installed, open up the IIS Manager MMC panel (if you have
it open already, you will need to restart it for the appropriate panel to
appear; this also means the server manager one might not be useful to you)
and navigate down to the administrator directory of the site. Click on the
"IPv4 Address and Domain Restrictions". You can change the default behaviour
by clicking "Edit Feature Settings" and setting the default value for
unspecified clients to deny. Then add allow entries for your trusted IP
addresses or subnets.
Check out the following article for details as well:
[[http://www.iis.net/ConfigReference/system.webServer/security/ipSecurity]]
(thanks to Sam Moffat for above info)

==[[Search Engine Friendly URLs]]==
The functioning of SEF URLs depends on "URL rewriting" - matching patterns in incoming HTTP requests, and passing the request to the webserver in a different format. Joomla can only understand the parameters present in the "ugly" request, so the human-readable path in the incoming HTTP request needs to be re-written for Joomla.

===Apache's mod_rewrite===
<code>mod_rewrite</code> is the familiar way by which many webmasters translate nice human-readable, spider-friendly URL requests like <code>/about_us/contact_information</code> into the "ugly" internal server path like <code>/index.php?option=com_content&view=article&id=999&Itemid=23</code> that makes Joomla serve up some content. A text file called .htaccess contains the rewrite rules, which are written according to a specific syntax.

===IIS===
Before Windows Server 2008 and IIS7, only third-party add-ons could add URL rewriting functionality to an IIS webserver. For servers today still running IIS6 or earlier, these are still available. CodePlex is a website and code-sharing developer forge associated with Microsoft, and it hosts at least two good-quality URL rewrite solutions for IIS6. At least one of these modules will parse and execute the same rewrite rules which work in Apache .htaccess files.

Windows Server 2008 comes with IIS7, which is the first webserver for which Microsoft provides a native module which provides URL rewriting functionality.

The module is called "IIS URL Rewrite Module" and is free to download and install on your IIS7 webserver.

The IIS7 module configures and stores its rules in a very different way than the format Apache provides via .htaccess. The rules are stored as XML data in the web.config file in a website's root. The IIS Management Console provides a GUI and wizard for creating and testing rules. The wizard is capable of reading a text file with .htaccess-type rules and converting them to the native format.

See [[Enabling Search Engine Friendly (SEF) URLs on IIS]] for instructions.

<noinclude>[[Category:IIS]][[Category:FAQ]]</noinclude>

IIS

2011-07-13T12:53:45Z

Jzlcdh: Added: Restricting access to the backend by IP address

Whilst IIS (Internet Information Services, a Microsoft web server) accounts for relatively few users, compared to Apache, there are enough to warrant providing information which is unique.

PHP can run on IIS, so a Joomla! web site also can run on IIS.

The PHP.net website should be referenced, regarding the installation of PHP on Windows and the configuraiton of IIS to process PHP webpages and scripts.

To get started, here are some helpful links for developers who want to install PHP and Joomla! on IIS.

* Install Joomla for Windows and IIS using the Web Platform Installer - http://www.microsoft.com/web/joomla
* PHP on Windows and IIS; building an IIS-optimized PHP - http://www.microsoft.com/web/php

The two most common problems encountered by Joomla! admins whose sites are on IIS webservers are:
* Setting the website's directory/filesystem permissions correctly
* Enabling SEF URLs

==Setting the filesystem permissions==

===Conceptual Overview===
Windows filesystem permissions are more complex than the 3-level, 3-value Unix-style <code>rw-r--r--</code> conventions.

Windows servers have a user called <code>IUSR</code>, which corresponds to the <code>apache</code> user on many Linux systems. PHP scripts run under the IUSR account.

====Levels====
A directory or file does have an <code>owner</code>, and Windows does have <code>group</code>s, but there is no <code>"everyone else"</code> under Windows.

There is a group called <code>Users</code>. This corresponds to all accounts used by human beings to deliberately interact with the server. But accounts for services, system operations, and software user permisions do not belong to that group, and in fact '''no''' accounts at all (human or otherwise) have '''any''' privileges which aren't explicitly granted either directly to the user or by membership in some group.

====Values====
Beyond <code>Read</code>, <code>Write</code> and <code>Execute</code>, Windows permissions include additional values. The important ones to know about for a Joomla website are <code>Read</code> and <code>Write</code>.

===HowTo configure the permissions===
When logged in to the Windows server, run Windows Explorer, and navigate to inetpub.

Right-click the directory which holds your Joomla site. 
Get Properties, tab to Security. 
Click ADD. 
Make sure that the LOCATION field is set to the local computer, not a domain controller. 
Type iis_iusrs into the field for identifying the user/group you are granting access to. 
Confirm. 
Highlight the iis_iusrs entry in the access control list. 
Check the boxes for Read & Execute, List Folder Contents, Read, and Write 
Confirm, put the security window away now. 
Open Start -. Administrator -> Computer Management. 
Navigate to Local Users and Groups -> Groups. 
Find or create the group iis_iusrs 
Add a member to the group: 
again, make sure that the LOCATION field is set to the local computer, not a domain controller. 
Type IUSR into the field for identifying the user/group you are granting access to. 
Confirm. 
Save. 

Run the Joomla installer again, and enjoy your PHP user's write privileges in your website folder.

==[[Restricting access to the backend by IP address]]==

You can utilise server based IP protection.
If you're running IIS 7.5 on Windows Server 2008, you can use the IP and
Domain Security option. Go to the Server Manager MMC panel and select
"Roles" and then "Web Server (IIS). From here select "Add Role Services" and
in the window that pops up, scroll down to security and select the "IP And
Domain Security Option" (see screenshot below) and then hit next to install.
Once you've got it installed, open up the IIS Manager MMC panel (if you have
it open already, you will need to restart it for the appropriate panel to
appear; this also means the server manager one might not be useful to you)
and navigate down to the administrator directory of the site. Click on the
"IPv4 Address and Domain Restrictions". You can change the default behaviour
by clicking "Edit Feature Settings" and setting the default value for
unspecified clients to deny. Then add allow entries for your trusted IP
addresses or subnets.
Check out the following article for details as well:
[[http://www.iis.net/ConfigReference/system.webServer/security/ipSecurity]]
(thanks to Sam Moffat for above info)

==[[Search Engine Friendly URLs]]==
The functioning of SEF URLs depends on "URL rewriting" - matching patterns in incoming HTTP requests, and passing the request to the webserver in a different format. Joomla can only understand the parameters present in the "ugly" request, so the human-readable path in the incoming HTTP request needs to be re-written for Joomla.

===Apache's mod_rewrite===
<code>mod_rewrite</code> is the familiar way by which many webmasters translate nice human-readable, spider-friendly URL requests like <code>/about_us/contact_information</code> into the "ugly" internal server path like <code>/index.php?option=com_content&view=article&id=999&Itemid=23</code> that makes Joomla serve up some content. A text file called .htaccess contains the rewrite rules, which are written according to a specific syntax.

===IIS===
Before Windows Server 2008 and IIS7, only third-party add-ons could add URL rewriting functionality to an IIS webserver. For servers today still running IIS6 or earlier, these are still available. CodePlex is a website and code-sharing developer forge associated with Microsoft, and it hosts at least two good-quality URL rewrite solutions for IIS6. At least one of these modules will parse and execute the same rewrite rules which work in Apache .htaccess files.

Windows Server 2008 comes with IIS7, which is the first webserver for which Microsoft provides a native module which provides URL rewriting functionality.

The module is called "IIS URL Rewrite Module" and is free to download and install on your IIS7 webserver.

The IIS7 module configures and stores its rules in a very different way than the format Apache provides via .htaccess. The rules are stored as XML data in the web.config file in a website's root. The IIS Management Console provides a GUI and wizard for creating and testing rules. The wizard is capable of reading a text file with .htaccess-type rules and converting them to the native format.

See [[Enabling Search Engine Friendly (SEF) URLs on IIS]] for instructions.

<noinclude>[[Category:IIS]][[Category:FAQ]]</noinclude>

Chunk:M16 Search Engine Friendly Joomal 1 6 Article

2011-02-14T16:45:05Z

Jzlcdh: /* How set up IIS URL Rewriting */

==IIS==

(Note: this IIS documentation may not apply to Joomla versions prior to 1.6: so please use the alternative documents which are available if you are not on Joomla 1.6 or above)

The IIS URL Rewrite module stores rules in a site's web.config file, expressed in XML format.
You can create the file yourself or use the GUI in the IIS Manager.

Apache .htaccess rules can be converted to the web.config format. You can import .htaccess rules using the GUI/wizard. For more information on converting .htaccess to web.config see http://learn.iis.net/page.aspx/557/translate-htaccess-content-to-iis-webconfig/

==How set up IIS URL Rewriting==

1) Make sure you are running on a version of IIS supported by your version of Joomla e.g. for Joomla 1.6 at least IIS7

2) Click on Site --> Global Configuration menu to configure SEO Settings:
"Search Engine Friendly URLs" to "Yes" and
"Use Apache Mod Rewrite" to "Yes"
[[Image:IIS_SEO_Settings.png]]

3) In IIS Manager check whether URL Rewrite is already installed
[[Image:IIS_URL_Rewrite.png]]

4) If it is not then from http://www.iis.net/download/URLRewrite either
a) Use the Microsoft Web Platform Installer to install IIS7 Recommended Configuration
or
b) Download URL Rewrite from the "x86" (if your Windows is 32 bit) or "x64" links and install.

5) Either
a) Use the IIS "URL Rewrite" pictured above to create your rules (regular expressions, wildcards or exact matches are all supported) e.g.

Pattern field: '''^([^/]+)/?$'''

Ignore case '''ON'''

Action type: '''Rewrite'''

Rewrite URL: '''index.php/'''

or

b) If it does not already exist; create and open a web.config file located in the C:\inetpub\wwwroot\joomla directory. Copy in the following code:

<source lang="xml">
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<clear />
<rule name="Common Exploit Blocking" stopProcessing="true">
<match url="^(.*)$" />
<conditions logicalGrouping="MatchAny">
<add input="{QUERY_STRING}" pattern="mosConfig_[a-zA-Z_]{1,21}(=|\%3D)" />
<add input="{QUERY_STRING}" pattern="base64_encode.*$.*$" />
<add input="{QUERY_STRING}" pattern="(\<|%3C).*script.*(\>|%3E)" />
<add input="{QUERY_STRING}" pattern="GLOBALS(=|\[|\%[0-9A-Z]{0,2})" />
<add input="{QUERY_STRING}" pattern="_REQUEST(=|\[|\%[0-9A-Z]{0,2})" />
</conditions>
<action type="Redirect" url="index.php" appendQueryString="false" redirectType="SeeOther" />
</rule>
<rule name="Joomla Search Rule" stopProcessing="true">
<match url="(.*)" ignoreCase="true" />
<conditions logicalGrouping="MatchAll">
<add input="{URL}" pattern="^/search.php" ignoreCase="true" />
</conditions>
<action type="Rewrite" url="/index.php?option=com_content&view=article&id=4" />
</rule>
<rule name="Joomla Main Rewrite Rule" stopProcessing="true">
<match url="(.*)" ignoreCase="true" />
<conditions logicalGrouping="MatchAll">
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
<add input="{URL}" pattern="(/|\.php|\.html|\.htm|\.feed|\.pdf|\.raw|/[^.]*)$" />
</conditions>
<action type="Rewrite" url="index.php/" />
</rule>
</rules>
</rewrite>
<caching>
<profiles>
<add extension=".php" policy="DisableCache" kernelCachePolicy="DisableCache" />
</profiles>
</caching>
</system.webServer>
</configuration>

</source>

File:IIS SEO Settings.png

2011-02-14T16:35:38Z

Jzlcdh: Screeenshot showing the settings to turn on SEF when using IIS.

Screeenshot showing the settings to turn on SEF when using IIS.

File:IIS URL Rewrite.png

2011-02-14T16:33:21Z

Jzlcdh: Screenshot showing the location of the URL Rewrite icon in IIS Manager.

Screenshot showing the location of the URL Rewrite icon in IIS Manager.

Chunk:M16 Search Engine Friendly Joomal 1 6 Article

2011-02-14T09:16:52Z

Jzlcdh: /* How set up IIS URL Rewriting */

==IIS==

(Note: this IIS documentation may not apply to Joomla versions prior to 1.6: so please use the alternative documents which are available if you are not on Joomla 1.6 or above)

The IIS URL Rewrite module stores rules in a site's web.config file, expressed in XML format.
You can create the file yourself or use the GUI in the IIS Manager.

Apache .htaccess rules can be converted to the web.config format. You can import .htaccess rules using the GUI/wizard. For more information on converting .htaccess to web.config see http://learn.iis.net/page.aspx/557/translate-htaccess-content-to-iis-webconfig/

==How set up IIS URL Rewriting==

1) Make sure you are running on a version of IIS supported by your version of Joomla e.g. for Joomla 1.6 at least IIS7

2) Click on Site --> Global Configuration menu to configure SEO Settings:
"Search Engine Friendly URLs" to "Yes" and
"Use Apache Mod Rewrite" to "Yes"
(screenshot to be added here)

3) In IIS Manager check whether URL Rewrite is already installed
(screenshot to be added here)

4) If it is not then from http://www.iis.net/download/URLRewrite either
a) Use the Microsoft Web Platform Installer to install IIS7 Recommended Configuration
or
b) Download URL Rewrite from the "x86" (if your Windows is 32 bit) or "x64" links and install.

5) Either
a) Use the IIS "URL Rewrite" pictured above to create your rules (regular expressions, wildcards or exact matches are all supported) e.g.
Pattern field: '''^([^/]+)/?$'''
Ignore case '''ON'''
Action type: '''Rewrite'''
Rewrite URL: '''index.php/'''

or

b) If it does not already exist; create and open a web.config file located in the C:\inetpub\wwwroot\joomla directory. Copy in the following code:

<source lang="xml">
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<clear />
<rule name="Common Exploit Blocking" stopProcessing="true">
<match url="^(.*)$" />
<conditions logicalGrouping="MatchAny">
<add input="{QUERY_STRING}" pattern="mosConfig_[a-zA-Z_]{1,21}(=|\%3D)" />
<add input="{QUERY_STRING}" pattern="base64_encode.*$.*$" />
<add input="{QUERY_STRING}" pattern="(\<|%3C).*script.*(\>|%3E)" />
<add input="{QUERY_STRING}" pattern="GLOBALS(=|\[|\%[0-9A-Z]{0,2})" />
<add input="{QUERY_STRING}" pattern="_REQUEST(=|\[|\%[0-9A-Z]{0,2})" />
</conditions>
<action type="Redirect" url="index.php" appendQueryString="false" redirectType="SeeOther" />
</rule>
<rule name="Joomla Search Rule" stopProcessing="true">
<match url="(.*)" ignoreCase="true" />
<conditions logicalGrouping="MatchAll">
<add input="{URL}" pattern="^/search.php" ignoreCase="true" />
</conditions>
<action type="Rewrite" url="/index.php?option=com_content&view=article&id=4" />
</rule>
<rule name="Joomla Main Rewrite Rule" stopProcessing="true">
<match url="(.*)" ignoreCase="true" />
<conditions logicalGrouping="MatchAll">
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
<add input="{URL}" pattern="(/|\.php|\.html|\.htm|\.feed|\.pdf|\.raw|/[^.]*)$" />
</conditions>
<action type="Rewrite" url="index.php/" />
</rule>
</rules>
</rewrite>
<caching>
<profiles>
<add extension=".php" policy="DisableCache" kernelCachePolicy="DisableCache" />
</profiles>
</caching>
</system.webServer>
</configuration>

</source>

Chunk:M16 Search Engine Friendly Joomal 1 6 Article

2011-02-14T09:16:12Z

Jzlcdh: /* How set up IIS URL Rewriting */

==IIS==

(Note: this IIS documentation may not apply to Joomla versions prior to 1.6: so please use the alternative documents which are available if you are not on Joomla 1.6 or above)

The IIS URL Rewrite module stores rules in a site's web.config file, expressed in XML format.
You can create the file yourself or use the GUI in the IIS Manager.

Apache .htaccess rules can be converted to the web.config format. You can import .htaccess rules using the GUI/wizard. For more information on converting .htaccess to web.config see http://learn.iis.net/page.aspx/557/translate-htaccess-content-to-iis-webconfig/

==How set up IIS URL Rewriting==

1) Make sure you are running on a version of IIS supported by your version of Joomla e.g. for Joomla 1.6 at least IIS7

2) Click on Site --> Global Configuration menu to configure SEO Settings:
"Search Engine Friendly URLs" to "Yes"
"Use Apache Mod Rewrite" to "Yes"
(screenshot to be added here)

3) In IIS Manager check whether URL Rewrite is already installed
(screenshot to be added here)

4) If it is not then from http://www.iis.net/download/URLRewrite either
a) Use the Microsoft Web Platform Installer to install IIS7 Recommended Configuration
or
b) Download URL Rewrite from the "x86" (if your Windows is 32 bit) or "x64" links and install.

5) Either
a) Use the IIS "URL Rewrite" pictured above to create your rules (regular expressions, wildcards or exact matches are all supported) e.g.
Pattern field: '''^([^/]+)/?$'''
Ignore case '''ON'''
Action type: '''Rewrite'''
Rewrite URL: '''index.php/'''

or

b) If it does not already exist; create and open a web.config file located in the C:\inetpub\wwwroot\joomla directory. Copy in the following code:

<source lang="xml">
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<clear />
<rule name="Common Exploit Blocking" stopProcessing="true">
<match url="^(.*)$" />
<conditions logicalGrouping="MatchAny">
<add input="{QUERY_STRING}" pattern="mosConfig_[a-zA-Z_]{1,21}(=|\%3D)" />
<add input="{QUERY_STRING}" pattern="base64_encode.*$.*$" />
<add input="{QUERY_STRING}" pattern="(\<|%3C).*script.*(\>|%3E)" />
<add input="{QUERY_STRING}" pattern="GLOBALS(=|\[|\%[0-9A-Z]{0,2})" />
<add input="{QUERY_STRING}" pattern="_REQUEST(=|\[|\%[0-9A-Z]{0,2})" />
</conditions>
<action type="Redirect" url="index.php" appendQueryString="false" redirectType="SeeOther" />
</rule>
<rule name="Joomla Search Rule" stopProcessing="true">
<match url="(.*)" ignoreCase="true" />
<conditions logicalGrouping="MatchAll">
<add input="{URL}" pattern="^/search.php" ignoreCase="true" />
</conditions>
<action type="Rewrite" url="/index.php?option=com_content&view=article&id=4" />
</rule>
<rule name="Joomla Main Rewrite Rule" stopProcessing="true">
<match url="(.*)" ignoreCase="true" />
<conditions logicalGrouping="MatchAll">
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
<add input="{URL}" pattern="(/|\.php|\.html|\.htm|\.feed|\.pdf|\.raw|/[^.]*)$" />
</conditions>
<action type="Rewrite" url="index.php/" />
</rule>
</rules>
</rewrite>
<caching>
<profiles>
<add extension=".php" policy="DisableCache" kernelCachePolicy="DisableCache" />
</profiles>
</caching>
</system.webServer>
</configuration>

</source>

Chunk:M16 Search Engine Friendly Joomal 1 6 Article

2011-02-14T09:15:41Z

Jzlcdh: /* How set up IIS URL Rewriting */

==IIS==

(Note: this IIS documentation may not apply to Joomla versions prior to 1.6: so please use the alternative documents which are available if you are not on Joomla 1.6 or above)

The IIS URL Rewrite module stores rules in a site's web.config file, expressed in XML format.
You can create the file yourself or use the GUI in the IIS Manager.

Apache .htaccess rules can be converted to the web.config format. You can import .htaccess rules using the GUI/wizard. For more information on converting .htaccess to web.config see http://learn.iis.net/page.aspx/557/translate-htaccess-content-to-iis-webconfig/

==How set up IIS URL Rewriting==

1) Make sure you are running on a version of IIS supported by your version of Joomla e.g. for Joomla 1.6 at least IIS7

2) Click on Site --> Global Configuration menu to configure SEO Settings:
"Search Engine Friendly URLs" to "Yes"
éUse Apache Mod Rewrite" to "Yes"
(screenshot to be added here)

3) In IIS Manager check whether URL Rewrite is already installed
(screenshot to be added here)

4) If it is not then from http://www.iis.net/download/URLRewrite either
a) Use the Microsoft Web Platform Installer to install IIS7 Recommended Configuration
or
b) Download URL Rewrite from the "x86" (if your Windows is 32 bit) or "x64" links and install.

5) Either
a) Use the IIS "URL Rewrite" pictured above to create your rules (regular expressions, wildcards or exact matches are all supported) e.g.
Pattern field: '''^([^/]+)/?$'''
Ignore case '''ON'''
Action type: '''Rewrite'''
Rewrite URL: '''index.php/'''

or

b) If it does not already exist; create and open a web.config file located in the C:\inetpub\wwwroot\joomla directory. Copy in the following code:

<source lang="xml">
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<clear />
<rule name="Common Exploit Blocking" stopProcessing="true">
<match url="^(.*)$" />
<conditions logicalGrouping="MatchAny">
<add input="{QUERY_STRING}" pattern="mosConfig_[a-zA-Z_]{1,21}(=|\%3D)" />
<add input="{QUERY_STRING}" pattern="base64_encode.*$.*$" />
<add input="{QUERY_STRING}" pattern="(\<|%3C).*script.*(\>|%3E)" />
<add input="{QUERY_STRING}" pattern="GLOBALS(=|\[|\%[0-9A-Z]{0,2})" />
<add input="{QUERY_STRING}" pattern="_REQUEST(=|\[|\%[0-9A-Z]{0,2})" />
</conditions>
<action type="Redirect" url="index.php" appendQueryString="false" redirectType="SeeOther" />
</rule>
<rule name="Joomla Search Rule" stopProcessing="true">
<match url="(.*)" ignoreCase="true" />
<conditions logicalGrouping="MatchAll">
<add input="{URL}" pattern="^/search.php" ignoreCase="true" />
</conditions>
<action type="Rewrite" url="/index.php?option=com_content&view=article&id=4" />
</rule>
<rule name="Joomla Main Rewrite Rule" stopProcessing="true">
<match url="(.*)" ignoreCase="true" />
<conditions logicalGrouping="MatchAll">
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
<add input="{URL}" pattern="(/|\.php|\.html|\.htm|\.feed|\.pdf|\.raw|/[^.]*)$" />
</conditions>
<action type="Rewrite" url="index.php/" />
</rule>
</rules>
</rewrite>
<caching>
<profiles>
<add extension=".php" policy="DisableCache" kernelCachePolicy="DisableCache" />
</profiles>
</caching>
</system.webServer>
</configuration>

</source>

Chunk:M16 Search Engine Friendly Joomal 1 6 Article

2011-02-14T09:01:52Z

Jzlcdh: /* How set up IIS URL Rewriting */

==IIS==

(Note: this IIS documentation may not apply to Joomla versions prior to 1.6: so please use the alternative documents which are available if you are not on Joomla 1.6 or above)

The IIS URL Rewrite module stores rules in a site's web.config file, expressed in XML format.
You can create the file yourself or use the GUI in the IIS Manager.

Apache .htaccess rules can be converted to the web.config format. You can import .htaccess rules using the GUI/wizard. For more information on converting .htaccess to web.config see http://learn.iis.net/page.aspx/557/translate-htaccess-content-to-iis-webconfig/

==How set up IIS URL Rewriting==

1) Make sure you are running on a version of IIS supported by your version of Joomla e.g. for Joomla 1.6 at least IIS7

2) Click on Site --> Global Configuration menu to configure SEO Settings: "Search Engine Friendly URLs" to "Yes"
(screenshot to be added here)

3) In IIS Manager check whether URL Rewrite is already installed
(screenshot to be added here)

4) If it is not then from http://www.iis.net/download/URLRewrite either
a) Use the Microsoft Web Platform Installer to install IIS7 Recommended Configuration
or
b) Download URL Rewrite from the "x86" (if your Windows is 32 bit) or "x64" links and install.

5) Either
a) Use the IIS "URL Rewrite" pictured above to create your rules (regular expressions, wildcards or exact matches are all supported) e.g.
Pattern field: '''^([^/]+)/?$'''
Ignore case '''ON'''
Action type: '''Rewrite'''
Rewrite URL: '''index.php/'''

or

b) If it does not already exist; create and open a web.config file located in the C:\inetpub\wwwroot\joomla directory. Copy in the following code:

<source lang="xml">
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<clear />
<rule name="Common Exploit Blocking" stopProcessing="true">
<match url="^(.*)$" />
<conditions logicalGrouping="MatchAny">
<add input="{QUERY_STRING}" pattern="mosConfig_[a-zA-Z_]{1,21}(=|\%3D)" />
<add input="{QUERY_STRING}" pattern="base64_encode.*$.*$" />
<add input="{QUERY_STRING}" pattern="(\<|%3C).*script.*(\>|%3E)" />
<add input="{QUERY_STRING}" pattern="GLOBALS(=|\[|\%[0-9A-Z]{0,2})" />
<add input="{QUERY_STRING}" pattern="_REQUEST(=|\[|\%[0-9A-Z]{0,2})" />
</conditions>
<action type="Redirect" url="index.php" appendQueryString="false" redirectType="SeeOther" />
</rule>
<rule name="Joomla Search Rule" stopProcessing="true">
<match url="(.*)" ignoreCase="true" />
<conditions logicalGrouping="MatchAll">
<add input="{URL}" pattern="^/search.php" ignoreCase="true" />
</conditions>
<action type="Rewrite" url="/index.php?option=com_content&view=article&id=4" />
</rule>
<rule name="Joomla Main Rewrite Rule" stopProcessing="true">
<match url="(.*)" ignoreCase="true" />
<conditions logicalGrouping="MatchAll">
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
<add input="{URL}" pattern="(/|\.php|\.html|\.htm|\.feed|\.pdf|\.raw|/[^.]*)$" />
</conditions>
<action type="Rewrite" url="index.php/" />
</rule>
</rules>
</rewrite>
<caching>
<profiles>
<add extension=".php" policy="DisableCache" kernelCachePolicy="DisableCache" />
</profiles>
</caching>
</system.webServer>
</configuration>

</source>

Chunk:M16 Search Engine Friendly Joomal 1 6 Article

2011-02-14T08:48:44Z

Jzlcdh: IIS SEO

==IIS==

(Note: this IIS documentation may not apply to Joomla versions prior to 1.6: so please use the alternative documents which are available if you are not on Joomla 1.6 or above)

The IIS URL Rewrite module stores rules in a site's web.config file, expressed in XML format.
You can create the file yourself or use the GUI in the IIS Manager.

Apache .htaccess rules can be converted to the web.config format. You can import .htaccess rules using the GUI/wizard. For more information on converting .htaccess to web.config see http://learn.iis.net/page.aspx/557/translate-htaccess-content-to-iis-webconfig/

==How set up IIS URL Rewriting==

1) Make sure you are running on a version of IIS supported by your version of Joomla e.g. for Joomla 1.6 at least IIS7

2) Click on Site --> Global Configuration menu to configure SEO Settings: "Search Engine Friendly URLs" to "Yes"

3) In IIS Manager check whether URL Rewrite is already installed

4) If it is not then from http://www.iis.net/download/URLRewrite either
a) Use the Microsoft Web Platform Installer to install IIS7 Recommended Configuration
or
b) Download URL Rewrite from the "x86" (if your Windows is 32 bit) or "x64" links and install.

5) Either
a) Use the IIS "URL Rewrite" pictured above to create your rules (regular expressions, wildcards or exact matches are all supported) e.g.
Pattern field: '''^([^/]+)/?$'''
Ignore case '''ON'''
Action type: '''Rewrite'''
Rewrite URL: '''index.php/'''

or

b) If it does not already exist; create and open a web.config file located in the C:\inetpub\wwwroot\joomla directory. Copy in the following code:

<source lang="xml">
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<clear />
<rule name="Common Exploit Blocking" stopProcessing="true">
<match url="^(.*)$" />
<conditions logicalGrouping="MatchAny">
<add input="{QUERY_STRING}" pattern="mosConfig_[a-zA-Z_]{1,21}(=|\%3D)" />
<add input="{QUERY_STRING}" pattern="base64_encode.*$.*$" />
<add input="{QUERY_STRING}" pattern="(\<|%3C).*script.*(\>|%3E)" />
<add input="{QUERY_STRING}" pattern="GLOBALS(=|\[|\%[0-9A-Z]{0,2})" />
<add input="{QUERY_STRING}" pattern="_REQUEST(=|\[|\%[0-9A-Z]{0,2})" />
</conditions>
<action type="Redirect" url="index.php" appendQueryString="false" redirectType="SeeOther" />
</rule>
<rule name="Joomla Search Rule" stopProcessing="true">
<match url="(.*)" ignoreCase="true" />
<conditions logicalGrouping="MatchAll">
<add input="{URL}" pattern="^/search.php" ignoreCase="true" />
</conditions>
<action type="Rewrite" url="/index.php?option=com_content&view=article&id=4" />
</rule>
<rule name="Joomla Main Rewrite Rule" stopProcessing="true">
<match url="(.*)" ignoreCase="true" />
<conditions logicalGrouping="MatchAll">
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
<add input="{URL}" pattern="(/|\.php|\.html|\.htm|\.feed|\.pdf|\.raw|/[^.]*)$" />
</conditions>
<action type="Rewrite" url="index.php/" />
</rule>
</rules>
</rewrite>
<caching>
<profiles>
<add extension=".php" policy="DisableCache" kernelCachePolicy="DisableCache" />
</profiles>
</caching>
</system.webServer>
</configuration>

</source>