Joomla configuration

Joomla

• Joomla CMS Version Must Be Up-to-date

  Every unpatched Joomla release has a public list of fixed vulnerabilities that attackers scan for automatically, so an outdated version is a standing target.

• Changes To Core Joomla Files Should Be Avoided

  Compares every core Joomla file against its known original hash, because hackers and old developer habits both like to alter files such as index.php directly.

• Disable Joomla 5.4+ Automatic Core Upgrades

  Joomla 5.4 introduces unattended core auto-updates; until that process is proven in production, an automatic major-version upgrade could break your site unsupervised.

  Fixable in one click

• Distributed robots.txt File Should Be Modified To Suit Your Site

  Flags a robots.txt that still matches the file Joomla ships by default, usually meaning nobody has told search engines what this particular site needs crawled.

• Remove FTP Configuration From Global Config

  Joomla's FTP layer stores your hosting FTP username and password in configuration.php in plain text, a working credential for anyone who can read that file.

  4.6% of the Joomla sites we have this data for fail it

• Site Should Not Be Set To Offline

  A site left offline serves the maintenance page to every visitor and to search engines, so traffic and rankings drain away while nobody notices.

  Fixable in one click

• Your Favicon Should Be Changed From Default Joomla Icon

  Checks your homepage for the stock Joomla favicon: this is a cosmetic branding signal, not a security issue, but it tells visitors the site was never finished.

• Joomla Global Email Configuration Should Work

  Sends a test email through your configured mail settings and confirms it arrives, since silent failures mean lost password resets and form submissions.

• Use A Joomla Core Or Akeeba Admin Tools .htaccess File

  Without a .htaccess file in your web root you lose the baseline security directives Joomla's own htaccess.txt or Akeeba Admin Tools would otherwise apply.

• Check Files That May Need Joomla 5 Compatibility Plugin (Beta)

  Searches your files for legacy class names Joomla 5 removed, flagging extensions likely to break once the backward-compatibility plugin is switched off.

• Robots.txt Should Not Block Media & Template Folders

  This is an SEO setting: blocking /media/ or /templates/ in robots.txt stops Google fetching the CSS, JS and images it needs to render your pages properly.

• Joomla Cache Configuration Should Be Enabled

  This is a performance setting, not a security one: enabling Joomla's page cache cuts database load and speeds up page delivery under traffic.

  Fixable in one click

• Log And Tmp Folders Should Use Default Locations

  This catches a common migration mistake, not a security risk: tmp and log paths copied from a local dev environment stop working once live, breaking installs and logging.

• Joomla SEF Configuration Should Be Enabled

  This is an SEO setting, not a security one: Search Engine Friendly URLs turn Joomla's index.php?option=... links into readable paths that rank and get clicked more.

  Fixable in one click0.7% of the Joomla sites we have this data for fail it

• Disable Mail To Friend To Prevent Spam

  Email To Friend lets any visitor send email from your server to an address of their choosing, which spammers abuse as a free mail relay.

  Fixable in one click

• Debug Mode Should Be Disabled

  Debug mode prints full SQL queries, file paths and stack traces straight onto the page, handing an attacker a map of your server and database structure.

  Fixable in one click1% of the Joomla sites we have this data for fail it

• Avoid Setting $live_site Unless Absolutely Necessary

  Setting $live_site overrides Joomla's automatic domain detection and is only needed on badly configured hosts, so leaving it set is usually a sign of bad advice followed, not a real fix.

• Admin Group Should Use Default Blacklist Text Filter

  Without the Default Blacklist filter, the Administrator group can save unfiltered HTML in content, letting a compromised admin account plant a stored XSS payload.

  Fixable in one click

• Disable Plain Text Password Emails

  When a user resets their password, Joomla can email the new password back to them in plain text, leaving a working credential sitting in an inbox indefinitely.

  Fixable in one click24% of the Joomla sites we have this data for fail it

• Disable Flash File Uploads

  A crafted .swf upload could once run JavaScript in your site's origin, a known Flash XSS trick; browsers no longer run Flash, so the risk today is mostly historical.

  Fixable in one click

• Error Reporting Should Be Set To None In Production

  Anything other than None prints PHP fatal errors, file paths and stack traces on the live site, handing visitors and attackers details of your server setup.

  Fixable in one click

• Disable Template Module Position Preview

  Appending ?tp=1 to any page reveals your template's module positions and site structure to anyone, information that helps an attacker plan further attacks.

  Fixable in one click

• Avoid Setting Cookie Domain/Path Unless Necessary

  Joomla works out its own cookie domain and path automatically; a manually set value is rarely needed and usually reflects bad advice followed rather than a real fix.

• Enable Session Garbage Collection Plugin

  This is housekeeping, not an active threat: without this plugin your #__session table can grow unchecked on some servers, eventually slowing queries against it.

  Fixable in one click

• Enable Google Recaptcha To Prevent Form Spam

  Without CAPTCHA, contact and registration forms are open to automated bots that flood them with spam submissions and fake account signups.

• Protect /administrator/ With .htaccess Password

  An .htaccess password on /administrator/ adds a second login prompt in front of Joomla's own, so a stolen or brute-forced admin password alone is not enough to reach it.

• Keep configuration.php Inside The Webroot

  Symlinking configuration.php outside the webroot is outdated advice that adds no protection: PHP still executes the file wherever the symlink points.

• Avoid Using Default Joomla Templates

  Sticking with a stock Joomla template makes your site instantly recognisable to attackers, and a core update can silently overwrite any edits made to those shared files.

• Session Lifetime Should Use The Default Value

  A longer than default session lifetime keeps a stolen login cookie valid for longer, so changing it without good reason widens the window an attacker has to reuse it.

• Enable Gzip Compression

  This is a performance setting, not a security one: Gzip compresses pages before sending them, cutting page weight and load time for visitors.

  Fixable in one click

• Enable IP Logging For User Actions

  Joomla's User Action Log can record the IP address behind every login and admin action, evidence you need after a break-in to work out how an account was used.

• Publish A Privacy Policy Using Joomla Privacy Tools

  This is a compliance setting: Joomla's Privacy Consent plugin needs an article assigned before it can ask visitors to consent, which most data protection laws require.

• Enable Joomla System Log Rotation

  Without log rotation, Joomla's system logs grow unchecked and can fill your disk, which can crash the site rather than just slow it down.

• Set Public, Guest And Registered Groups To 'No HTML'

  Without the No HTML filter, the Public, Guest and Registered groups can submit raw HTML and script tags through any form that saves their input, an easy route to stored XSS.

• $root_user Should Not Be Defined In configuration.php

  $root_user grants whichever account it names full Super User power regardless of that account's real permissions, so a forgotten value is a standing backdoor.

• Debug Language Should Not Be Enabled In Production

  Language debug mode prints the raw translation string constants next to the translated text on every page, exposing template and extension internals to visitors.

  Fixable in one click

• Action And Hide Post Install Messages

  This is housekeeping, not a security check: post-install messages from Joomla core and extensions carry upgrade notices worth reading and dismissing, nothing more.

• Disable Send Copy To Submitter To Prevent Spam

  The `Send Copy To Submitter` feature can be used by spammers by allowing them to put their targets email address in the form, use this tool to disable it.

  Fixable in one click

• Use Default Update Channel To Prevent Accidental Series Jump

  A non-default update channel can quietly offer a pre-release or next major series build, so a routine update could jump your site onto an untested Joomla version.

  Fixable in one click

• Fix Known Joomla 3 End Of Life Security Issues

  Joomla 3 stopped receiving security fixes in August 2023, so every flaw found since then stays open on the site permanently.

  Fixable in one click

• Disable Joomla Core Update Notification Emails

  Disable Joomla core update available notification emails

  Fixable in one click

• Disable Log Everything To Prevent Huge Log Files

  Log Everything writes a line for every action Joomla takes, which fills the disk on a busy site and can take the whole site down with it.

  Fixable in one click

• Disable Log Deprecated To Prevent Huge Log Files

  Logging deprecated API calls is a developer aid, and on a live site it just grows a log file nobody reads until the disk is full.

  Fixable in one click

• Use A Valid SSL Certificate To Secure Traffic

  Without HTTPS, everything a visitor sends, including login forms and session cookies, travels in plain text and can be read or altered by anyone on the network path.

• Investigate Locked Scheduled Tasks

  Detect Joomla scheduled tasks that are stuck in a locked state

• Enable Joomla module versioning for safe rollback of module edits

  Joomla can keep previous versions of a module's settings, so a bad edit to a live module can be rolled back instead of rebuilt from memory.

• Enable Proof-of-Work Captcha To Prevent Form Spam

  Detect Joomla 6.1+ sites that have not enabled the built-in proof-of-work captcha

• Unblock mySites.guru IP in Akeeba Admin Tools

  Find sites where Akeeba Admin Tools has auto-banned the mySites.guru IP, blocking audits and snapshots

• Language update sites point to the wrong Joomla version

  After a Joomla 5 to 6 upgrade, language update sites can stay pinned to the old version so language packs never update. This finds and fixes them.

• Force SSL Should Be Set To Entire Site

  With Force SSL set to admin-only or off, front-end pages including login and password-reset links can still be served over plain HTTP, exposing them to interception.

  Fixable in one click

• Force Multi-Factor Authentication For Super Users

  Without forced MFA, a Super User account can be accessed with a password alone, so a leaked or guessed admin password is enough for full site control.

  Fixable in one click99% of the Joomla sites we have this data for fail it

• Article Options Ignored (Joomla 5.4.7 & 6.1.2)

  Find Joomla 5.4.7 / 6.1.2 sites whose per-article Options are silently ignored on the front end

• Template Manager Broken (Joomla 5.4.8 & 6.1.3)

  Find Joomla 5.4.8 / 6.1.3 sites whose Template Manager cannot create overrides or folders

• Don't Share Site & Admin Sessions

  Don't share site and administrator sessions

  Fixable in one click4.2% of the Joomla sites we have this data for fail it