Joomla Security Basics

Keeping Joomla Up-To-Date

Install the Joomla Automatic Plugin and make updating Joomla website a one click affair. There is no excuse, for not keeping a Joomla website up-to-date.

URL: http://joomlacode.org/gf/project/pasamioprojects/frs/?action=FrsReleaseBrowse&frs_package_id=4728

Move confidential files outside public_html
(i.e. the root directory of most websites)

One challenge in Joomla! is ensuring that certain PHP files which are normally found in public_html and contain executable code or confidential data are protected from direct Internet access.

There are various ways to protect such files, but most are not optimal.

Many users and developer groups, such as Gallery2 and Apache.org strongly recommend against keeping vulnerable files and confidential data inside public_html.

The following method seems to be the simplest and most elegant way to protect read-only files that, for whatever reason, must be stored in public_html.

In this example, the file configuration.php, perhaps the most confidential file of any Joomla! site is being protected

Using this method, even if the Web server somehow delivers the contents of PHP files, for example due to a misconfiguration, nobody can see the contents of the real configuration file.

DIRECTIONS:

Move configuration.php to a safe directory outside of public_html and rename it whatever you want. The name dss.conf is used in this example.

Create a new configuration.php file containing only the following code

<?php require( dirname( __FILE__ ) . '/../cnf/dss.conf' );

Make sure the new configuration.php file is not writable, so that it cannot be overwritten by the Joomla! Web admin interface.

Create a new directory called cnf outside public_html. Place the dss.cnf fil