Powered by Blogger.
Tuesday, March 5, 2013

Default Joomla admin url , security risk and solution

Hello All, Today i will tell you about an important security risk of Joomla websites. By default for Joomla website the admin url is "/administrator" means if your Joomla websites url is http://www.domain.com then by default your Joomla websites administrator url will be http://www.domain.com/administrator/

Now this is not safe. Joomla websites are very easy to find also for expert hackers its not very hard to hack your site. So to protect your Joomla website, you should hide your joomla administrator url.

This can be done very easily by using popular plugins like jSecure (paid) or kSecure(free)
If you install jSecure on your Joomla website and enable the plugin. It will hide your administrator url. That means now if anyone try to access  /administrator  path , he will be redirected to the homepage. Only you will know the security key and you will be able to see the administrator. By default  for Jsecure plugin  the security key is  "jSecure" (case-sensative)   that means to see the administrator url. You will have to write the url like this   http://www.domain.com/administrator/?jSecure

You should update the security key. Go to administrator. Components > jSecure Authentication > Basic configuration



Here you will be able to see a field for Key. Fill it with your own security key ( not the Joomla admin password. Something else ) and save.

Now Jsecure offers you a lot of other security options. So i always use jSecure on my Joomla website. It worth the 10$

The other free plugin kSecure . Is just an plugin inspired by jSecure. You can download it free from : http://www.kareebu.com/downloads/download?path=kSecure.zip

Install it on your joomla website and then go to plugin manager and enable the plugin named
System - kareebu Secure
Then edit the plugin and fill the password field and enable the http authentication and then save.


By the way you should not install both these two plugins in your website. Use only one. If you install both it can create an conflict. Try to use jSecure. Its better. Personally i do not like kSecure. 

So this is it. It will hide your joomla websites admin url. So even if someone managed to find your password , he will not find your administrator login page :)  Enjoy..