Security FAQ: Difference between revisions

From Joomla! Documentation

← Older editNewer edit →
Tom Hutchison (talk | contribs)
Email Confirmed
13,131 edits
m →More Tips: updating links
Cmb (talk | contribs)
956 edits
Corrected URLs and made some markup changes.
Line 1: Line 1:
This security list has been compiled from several sources. Some of these sources are linked at the bottom of this article. As such you may find duplicate suggestions. DON'T skip anything because of this!
This security list has been compiled from several sources. Some of these sources are linked at the bottom of this article. As such you may find duplicate suggestions. '''Don't''' skip anything because of this!


This list for the main part does not provide instructions. It is only a list for you to check off each item as you perform the tasks.
This list for the main part does not provide instructions. It is only a list for you to check off each item as you perform the tasks.


I know this list will generate MANY questions; please post to the joomla.org forum:
This list might generate many questions. Please post to the [https://forum.joomla.org/viewforum.php?f=813 Security in Joomla! 4.x] or the [https://forum.joomla.org/viewforum.php?f=714 Security in Joomla! 3.x] forums.
http://forum.joomla.org/viewforum.php?f=432&sid=81c2aa9b5a4a88574ae79a6b176111cc


== Security Checklist ==
== Security Checklist ==
# Change username "admin" to anything else in Joomla, PhpBB, and anywhere else it used.
# Change username ''admin'' to anything else in Joomla, phpBB, and anywhere else it used.
# Change database tables prefix from "jos_" to anything else.
# Change database tables prefix from ''jos_'' to anything else.
# Change username or add password to username "root" in PhpMyAdmin. Default is NO password! This is not usually an issue on remote servers however if you have a local server it may be.
# Change username or add password to username ''root'' in phpMyAdmin. Default is '''no''' password! This is not usually an issue on remote servers. However if you have a local server, it may be.
# It does not matter if your host does backups. Do it yourself too, and store them anywhere else other than the server.
# It does not matter if your host does backups. Do it yourself and store them anywhere other than the server.
# Backup up often! You would be amazed at how many site owners '''never''' perform regular backups. Don't be one of those persons.
# Backup up often! You would be amazed at how many site owners '''never''' perform regular backups. Don't be one of those persons.
# Test your backup. Verify that your backup procedure works.
# Test your backup. Verify that your backup procedure works.
# Remove unused templates, extensions and unneeded files from your site. This includes compressed archives.
# Remove unused templates, extensions and unneeded files from your site. This includes compressed archives.
# Check joomla.org Vulnerable Extensions List (VEL)
# Check [https://extensions.joomla.org/vulnerable-extensions/vulnerable/ Joomla Vulnerable Extensions List (VEL)]
# Check regularly for updates for Joomla, PHP, SQL and EVERY extension you use.
# Check regularly for updates for Joomla, PHP, SQL and '''every''' extension you use.
# Avoid encrypted code in extensions.
# Avoid encrypted code in extensions.
# Use some form of intrusion detection either through a cron job or an extension (like Eyesite).
# Use some form of intrusion detection either through a cron job or an extension (like Eyesite).
# Check your log files OFTEN for unusual activity.
# Check your log files OFTEN for unusual activity.
# Test your site for weaknesses or hire someone to perform this for you. Make sure you tell your host first what you are doing or you may get your site removed from the server!!!
# Test your site for weaknesses or hire someone to perform this for you. Make sure you tell your host first what you are doing or you may get your site removed from the server!
# Ask your server if they offer PHPsuExec, php_suexec or suPHP.
# Ask your server if they offer PHPsuExec, php_suexec or suPHP.
# Use php.ini files if your server allows. With this you can disable functions that are not needed or dangerous.
# Use ''php.ini'' files if your server allows. With this you can disable functions that are not needed or dangerous.
# Register_Globals = 0 (off) Many servers default this to ON.
# ''Register_Globals = 0'' (off) Many servers default this to ON.
# allow_url_fopen = 0 (off)
# ''allow_url_fopen = 0'' (off)
# expose_php = 0 (off)
# ''expose_php = 0'' (off)
# safe_mode = 0 (off)
# ''safe_mode = 0'' (off)
# Use .htaccess to add extra protection to your administrator directory or use an extension (like kSecure).
# Use '.htaccess' to add extra protection to your Administrator directory or use an extension (like kSecure).
# Move configuration.php outside of your public directory.
# Move ''configuration.php'' outside of your public directory.
# Get an SSL certificate for financial transactions and other sensitive data exchange.
# Get an SSL certificate for financial transactions and other sensitive data exchange.
# Use open_basedir. It limits which files/folders can be opened.
# Use ''open_basedir''. It limits which files/folders can be opened.
# Change the paths (directories) where your log, temp (tmp) files are stored. Don't just move them, you have to change the setting in Global Config as well. You also have to ensure your new paths fall under the scope of open_basedir.
# Change the paths (directories) where your ''log'', ''temp'' (''tmp'') files are stored. Don't just move them, you have to change the setting in Global Configuration as well. You also have to ensure your new paths fall under the scope of ''open_basedir''.
# If your administrator password is changed by hackers (or you forget it) follow this procedure to restore it: http://docs.joomla.org/How_do_you_recover_your_admin_password%3F
# If your Administrator password is changed by hackers (or you forget it) follow this procedure to restore it: [https://docs.joomla.org/How_do_you_recover_or_reset_your_admin_password%3F How do you recover or reset your admin password?]


== More Tips ==
== More Tips ==
7 Great Tips from Marco Folio (Some with instructions):
[http://old.marcofolio.net/joomla/7_tips_to_optimize_joomla_security.html 7 tips to optimize Joomla! security]
http://www.marcofolio.net/joomla/7_tips_to_optimize_joomla_security.html


How to prevent an SQL injection by Marco Folio:
[http://old.marcofolio.net/features/how_you_can_prevent_an_sql_injection.html How you can prevent an SQL injection]
http://www.marcofolio.net/features/how_you_can_prevent_an_sql_injection.html


Joomla Security Primer by Tom Canavan:
[[:Category:Security Checklist|Joomla! Security Checklist Category]]
http://www.howtojoomla.net/how-tos/security/joomla-security-primer


Joomla.org Security Checklist Wiki:
[https://extensions.joomla.org/vulnerable-extensions/vulnerable/ Joomla Vulnerable Extensions List (VEL)]
[[:Category:Security Checklist|Security Checklist]]
 
Joomla.org Vulnerable Extensions List:
[http://vel.joomla.org Vulnerable Extensions List]

Revision as of 23:45, 29 September 2022

This security list has been compiled from several sources. Some of these sources are linked at the bottom of this article. As such you may find duplicate suggestions. Don't skip anything because of this!

This list for the main part does not provide instructions. It is only a list for you to check off each item as you perform the tasks.

This list might generate many questions. Please post to the Security in Joomla! 4.x or the Security in Joomla! 3.x forums.

Security Checklist

  1. Change username admin to anything else in Joomla, phpBB, and anywhere else it used.
  2. Change database tables prefix from jos_ to anything else.
  3. Change username or add password to username root in phpMyAdmin. Default is no password! This is not usually an issue on remote servers. However if you have a local server, it may be.
  4. It does not matter if your host does backups. Do it yourself and store them anywhere other than the server.
  5. Backup up often! You would be amazed at how many site owners never perform regular backups. Don't be one of those persons.
  6. Test your backup. Verify that your backup procedure works.
  7. Remove unused templates, extensions and unneeded files from your site. This includes compressed archives.
  8. Check Joomla Vulnerable Extensions List (VEL)
  9. Check regularly for updates for Joomla, PHP, SQL and every extension you use.
  10. Avoid encrypted code in extensions.
  11. Use some form of intrusion detection either through a cron job or an extension (like Eyesite).
  12. Check your log files OFTEN for unusual activity.
  13. Test your site for weaknesses or hire someone to perform this for you. Make sure you tell your host first what you are doing or you may get your site removed from the server!
  14. Ask your server if they offer PHPsuExec, php_suexec or suPHP.
  15. Use php.ini files if your server allows. With this you can disable functions that are not needed or dangerous.
  16. Register_Globals = 0 (off) Many servers default this to ON.
  17. allow_url_fopen = 0 (off)
  18. expose_php = 0 (off)
  19. safe_mode = 0 (off)
  20. Use '.htaccess' to add extra protection to your Administrator directory or use an extension (like kSecure).
  21. Move configuration.php outside of your public directory.
  22. Get an SSL certificate for financial transactions and other sensitive data exchange.
  23. Use open_basedir. It limits which files/folders can be opened.
  24. Change the paths (directories) where your log, temp (tmp) files are stored. Don't just move them, you have to change the setting in Global Configuration as well. You also have to ensure your new paths fall under the scope of open_basedir.
  25. If your Administrator password is changed by hackers (or you forget it) follow this procedure to restore it: How do you recover or reset your admin password?

More Tips

7 tips to optimize Joomla! security

How you can prevent an SQL injection

Joomla! Security Checklist Category

Joomla Vulnerable Extensions List (VEL)

Retrieved from "https://docs.sandbox.joomla.org/index.php?title=Security_FAQ&oldid=989188"