Joomla Security Guide — Protect Your Website from Threats
Most Joomla security breaches are preventable. They do not result from sophisticated attacks against the Joomla core — they result from outdated installations, unpatched extensions, weak administrator credentials, and hosting environments that have not been properly configured. This guide covers the security measures that actually matter for protecting your Joomla website.
The Biggest Risk: Running an End-of-Life Joomla Version
No amount of security hardening compensates for running an unsupported Joomla version. If your website runs Joomla 3 (end of life August 2023) or Joomla 4 (end of life October 2025), the most important security action you can take is upgrading to a supported version.
Unsupported Joomla versions do not receive security patches. When a vulnerability is discovered and patched in Joomla 5 or 6, the same vulnerability remains open in Joomla 3 and 4 — permanently. The vulnerability details are published in the Joomla Security Centre, effectively providing attackers with a roadmap for exploiting older installations.
Extensions: Your Largest Attack Surface
The majority of Joomla security breaches originate from third-party extensions, not from the Joomla core. This is because extension code quality varies enormously, abandoned extensions never receive security patches, and a typical Joomla site may have 15 to 50 extensions installed — each one a potential entry point.
Extension Security Best Practices
- Remove what you do not use. Every installed extension is attack surface. If an extension is installed but not actively used, uninstall it completely — disabling is not sufficient, as the code remains on the server and may still be accessible.
- Update promptly. When an extension releases an update, apply it — especially if the changelog mentions security fixes. Test in staging first, then deploy.
- Monitor for abandonment. If an extension has not been updated in over 12 months, consider it abandoned and plan a replacement. An abandoned extension will never receive another security patch.
- Check the Vulnerable Extensions List. The Joomla Extensions Directory maintains a list of extensions with known vulnerabilities. Check your installed extensions against this list.
- Choose quality over quantity. Use the minimum number of extensions necessary. Before installing a new extension, verify that the functionality is not already available in the Joomla core or in an extension you already have.
For extension recommendations, see our Joomla Extensions Guide.
Administrator Access Hardening
Strong Credentials
Do not use "admin" as your administrator username. Do not use simple passwords. Use a password manager to generate unique, complex passwords for every Joomla administrator account. This is basic security hygiene but it remains the single most common weakness we encounter during site audits.
Two-Factor Authentication (2FA)
Joomla 5 and 6 include built-in two-factor authentication. Enable it for all administrator accounts. 2FA adds a second verification step — typically a time-based code from an authenticator app — that prevents unauthorised access even if the password is compromised. There is no good reason not to use it.
Limit Administrator Access
Not every backend user needs Super Administrator access. Joomla's user group system allows you to create roles with specific, limited permissions. Content editors should have content editing permissions, not system configuration access. The principle of least privilege applies to CMS access just as it applies to any other system.
Administrator Directory Protection
Adding an additional layer of protection to your /administrator directory — through server-level password protection (.htpasswd), IP restriction, or a secret URL parameter — makes it significantly harder for automated tools to find and attack your login page. This does not replace strong credentials and 2FA, but it reduces the volume of brute-force attempts your site must handle.
Server and Hosting Security
PHP Version
Run the latest supported PHP version (PHP 8.2 or 8.3 for Joomla 5/6). Older PHP versions do not receive security patches. Running Joomla on an unsupported PHP version negates many of the security improvements in the CMS itself.
File Permissions
Correct file permissions prevent unauthorised modification of your Joomla files. As a general rule: directories should be set to 755, files should be set to 644, and the configuration.php file should be set to 444 (read-only). Your hosting environment may require slightly different settings — consult your hosting provider if unsure.
SSL/TLS (HTTPS)
Your entire website must be served over HTTPS. This protects data transmitted between visitors and your server — including login credentials, form submissions, and session cookies. There is no legitimate reason to serve a Joomla website over HTTP in 2026. Free SSL certificates are available through Let's Encrypt and most hosting providers.
Web Application Firewall (WAF)
A web application firewall filters malicious requests before they reach your Joomla installation. Server-level WAFs (ModSecurity, LiteSpeed WAF) or cloud-based WAFs (Cloudflare, Sucuri) provide protection against common attacks including SQL injection, cross-site scripting, and file inclusion attempts.
Regular Backups
Backups are your last line of defence. If a security incident occurs despite all preventive measures, a clean, tested backup allows you to restore your site to its pre-compromise state. Automated daily backups stored off-server, with regular restore testing, are essential. Akeeba Backup is the standard tool for this.
Joomla Core Security Configuration
Keep Joomla Updated
Apply Joomla core updates promptly when they are released. Test in staging first, then deploy to production. Joomla 5.4 and 6 support automatic minor version updates — enable this feature if you are confident in your extension compatibility, or work with a maintenance provider to manage updates in a controlled manner.
Global Configuration Security Settings
Joomla's Global Configuration includes several security-relevant settings. Force HTTPS should be enabled. Session lifetime should be set to a reasonable duration (15-30 minutes for administrator sessions). Error reporting should be set to "None" or "System Default" on production sites (never "Maximum" — this exposes server paths and configuration details to potential attackers).
User Registration
If your website does not require public user registration, disable it. Open user registration is a common vector for spam accounts and, in poorly configured installations, can be exploited for privilege escalation. If you do need public registration, implement CAPTCHA and require email verification.
What to Do If Your Site Is Hacked
If you suspect your Joomla website has been compromised:
- Do not panic, but act quickly. The longer a compromise persists, the more damage it causes — to your data, your visitors, and your reputation.
- Take the site offline. Put up a maintenance page to prevent visitors from being exposed to malicious content.
- Do not simply restore from backup. The vulnerability that allowed the compromise still exists. Restoring without addressing the root cause means the attacker can simply re-enter through the same weakness.
- Identify the entry point. Determine how the attacker gained access — was it an unpatched extension, a weak password, a file upload vulnerability, or a server-level issue?
- Clean the compromise. Remove all malicious files, backdoor scripts, and injected code. Check the database for injected content. Review user accounts for unauthorised administrators.
- Patch the vulnerability. Update the component that was exploited, change all passwords, and implement the preventive measures described in this guide.
- Restore and verify. Bring the site back online and monitor closely for signs of re-compromise.
- Consider professional help. Cleaning a hacked website thoroughly requires expertise. A missed backdoor script means the attacker retains access even after you think the site is clean.
Security Is Ongoing
Security is not a one-time configuration. Threats evolve, new vulnerabilities are discovered, and the extension landscape changes constantly. Structured, ongoing maintenance — regular updates, monitoring, and periodic security reviews — is the most reliable way to keep a Joomla website secure over time.
Our maintenance plans include security monitoring, update management, and backup verification as core services. Our managed hosting provides server-level security including firewalls, DDoS protection, and proactive monitoring.
Get a Security Assessment
Our free site audit includes a security assessment — we check your Joomla version, PHP version, extension vulnerability status, SSL configuration, and common misconfigurations. You receive a clear report showing where your site stands and what needs attention.