Joomla Security Hardening — .htaccess, 2FA, Updates and File Permissions

In this tutorial, you'll learn how to harden your Joomla site security — configuring .htaccess rules, enabling Two-Factor Authentication for admin accounts, keeping Joomla and extensions updated, setting correct file permissions, and following security best practices.

What You'll Learn

• How to configure htaccess.txt for security (IndexIgnore, block bad bots, XSS protection)
• How to enable Two-Factor Authentication for administrators
• How to keep Joomla core and extensions updated
• How to set correct file permissions
• How to check file integrity against JED checksums
• How to use the Security Center dashboard
• Admin best practices: strong passwords, limited Super Users
• How to register for Joomla Security Announcements

Why It Matters

Joomla powers millions of websites, making it a target for automated attacks. A compromised Joomla site can lead to data theft, malware distribution, reputation damage, and blacklisting by search engines. Most Joomla hacks are preventable with basic security measures. Security is not optional — it is a fundamental responsibility of every site owner.

Real-World Use

A Joomla site is attacked by a bot that tries to access /administrator/ with common usernames. The site has Admin Password Protection enabled through .htaccess, so the bot gets a 403 Forbidden response before reaching the Joomla login page. The Super User account has 2FA enabled. The site is running the latest Joomla version with all extensions updated. The attack fails at every layer.

Learning Path

flowchart LR
  A["Global Configuration"] --> B["Security Hardening
You are here"]:::current
  B --> C["Caching"]
  C --> D["SEO"]

  classDef current fill:#38bdf8,color:#0f172a,stroke-width:2px

.htaccess Security

Joomla ships with a file called htaccess.txt in the root directory. This file contains Apache rules for security and SEO. To activate it:

# Activate .htaccess security
# Rename htaccess.txt to .htaccess
# This enables rewrite rules, blocking, and headers

cp htaccess.txt .htaccess

Key .htaccess Rules

The default htaccess.txt includes several important rules. Here is what they do:

# Prevent directory listing — visitors cannot see folder contents
Options -Indexes

# Protect configuration.php — contains database credentials
<Files "configuration.php">
  Require all denied
</Files>

# Block access to sensitive files
<FilesMatch "(\.sql|\.log|\.md|\.txt)$">
  Require all denied
</FilesMatch>

# Block user enumeration — prevents attackers from finding usernames
RewriteCond %{QUERY_STRING} ^option=com_users&view=reset&layout=confirm [OR]
RewriteCond %{QUERY_STRING} ^option=com_users&task=registration.*
RewriteRule .* - [F]

Additional .htaccess Security Rules

You can add these rules to enhance security:

# Block bad bots and scrapers
RewriteCond %{HTTP_USER_AGENT} ^.*(ahrefs|semrush|dotbot|mj12bot|majestic).*$ [NC]
RewriteRule .* - [F,L]

# Block access to /administrator/ by IP (replace with your IP)
<LocationMatch "/administrator/">
  Require ip 192.168.1.100
  Require ip 10.0.0.0/8
</LocationMatch>

# Security headers
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

Content Security Policy (CSP)

A Content Security Policy controls which resources can load on your site:

# CSP example — only allow resources from your domain
<IfModule mod_headers.c>
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self';"
</IfModule>

CSP prevents XSS attacks by blocking inline scripts and external resource loads that are not explicitly allowed.

Two-Factor Authentication

Joomla supports Two-Factor Authentication (2FA) in the core. Enable it for all administrator accounts, especially Super Users.

Setting Up 2FA

# Enable 2FA for a user
# Users > Manage > Click user name
# Multi-factor Authentication tab
# Choose method:
#   - Authenticator (Google Authenticator, Authy, etc.)
#   - WebAuthn (biometric, security keys)
# Follow the setup wizard
# Save

2FA Methods

Enforcing 2FA for All Super Users

Joomla can require all Super Users to have 2FA enabled:

# Force 2FA for Super Users
# Users > User Group > Super Users
# Multi-factor Authentication: Required
# Users without 2FA will be prompted to set it up on next login

Keeping Joomla Updated

Joomla releases regular security updates. Keeping your site updated is the single most important security practice.

Update Types

How to Update

# Update Joomla core
# Extensions > Manage > Update
# Click "Find Updates"
# Select the Joomla update
# Click "Update Now"
# Backup before updating!

Update Workflow

1. Backup your site (files + database)
2. Test the update on a staging copy
3. Run the update on the live site
4. Clear cache (System > Clear Cache)
5. Run Database Fix (Extensions > Manage > Database)
6. Check file integrity
7. Verify frontend and backend functionality

File Permissions

Correct file permissions prevent attackers from modifying your site files.

Recommended Permissions

# File permissions (production)
configuration.php:  444 (read-only for everyone)
All directories:    755 (owner can write, others read/execute)
All files:          644 (owner can write, others read)
/tmp:              777 (temporary files, writeable by all)
/log:              777 (log files, writeable by all)

# Setting permissions via command line
find /var/www/html -type d -exec chmod 755 {} \;
find /var/www/html -type f -exec chmod 644 {} \;
chmod 444 /var/www/html/configuration.php
chmod 777 /var/www/html/tmp
chmod 777 /var/www/html/log

Why Permissions Matter

• configuration.php (444): Contains database username, password, and other secrets. If writeable, an attacker can modify it or inject malicious code.
• Directories (755): Allows the web server to read and traverse directories but not write files. Prevents arbitrary file uploads.
• Files (644): Allows reading by everyone but writing only by the owner. Prevents unauthorized file modification.

File Integrity Check

Joomla can compare your installed core files against the checksums from the Joomla Extensions Directory.

# Check file integrity
# Extensions > Manage > Check File Integrity
# Click "Check Files" button
# Joomla compares each file against the official version
# Results show:
#   - Files that match (green)
#   - Files that were modified (orange)
#   - Files that are missing (red)
#   - Files that should not be there (red)

Run this check regularly, especially after noticing unusual site behavior. Modified core files may indicate a hack.

Security Center

The Security Center (System > Security Center) provides a dashboard of security-related information:

# Access Security Center
# System > Security Center
# Check:
#   - Joomla version status (up-to-date or outdated)
#   - Extension update status
#   - File integrity status
#   - Security settings checklist

The Security Center shows a checklist of recommended security settings and highlights anything that needs attention.

Admin User Best Practices

Username Best Practices

# DO NOT use "admin" as your Super User username
# Attackers target "admin" in brute force attacks

# Good username: "jdoe" or "john.doe"
# Bad username: "admin" or "administrator"

Password Best Practices

• Minimum 12 characters
• Mix of uppercase, lowercase, numbers, and symbols
• Unique per site (do not reuse passwords)
• Change every 90 days for admin accounts
• Use a password manager

Limit Super Users

Only create Super User accounts for people who absolutely need full access. For everyone else, use Administrator or Manager accounts with specific permissions.

# Hierarchy of admin accounts
# Super Users: 1-2 people max (site owners, lead developers)
# Administrator: 2-5 people (content managers who need backend access)
# Manager: 5-20 people (department managers)
# Editor: Content editors without admin access

Security Announcements

Register for the Joomla Security Strike Team (JSST) mailing list to receive security announcements:

# Subscribe to Joomla Security Announcements
# Visit https://developer.joomla.org/security-centre.html
# Subscribe to the JSST mailing list
# You will receive email notifications about:
#   - New Joomla releases
#   - Security vulnerabilities
#   - Recommended actions

Additional Security Measures

Web Application Firewall (WAF)

Install Akeeba Admin Tools or similar extension for WAF protection:

# Admin Tools WAF features
# - Blocks SQL injection attempts
# - Blocks XSS attacks
# - Blocks file inclusion attacks
# - Blocks bad bots
# - Rate limiting on login attempts

SSL/TLS Certificate

Always use HTTPS on your Joomla site:

# Enable SSL in Global Configuration
# System > Global Configuration > Server tab
# Site SSL: "Entire Site" (forces HTTPS on all pages)
# Requires a valid SSL certificate installed on your server

Regular Backups

Backups are your last line of defense:

# Backup schedule
# Daily: Database backup
# Weekly: Full site backup (files + database)
# Before every update: Backup
# Store backups off-server (S3, Dropbox, etc.)

Common Mistakes

1. Using "admin" as the username: You install Joomla and use "admin" as your Super User username. Automated bots try "admin" with thousands of passwords. Always use a unique username for Super Users.

2. Not activating htaccess.txt: You install Joomla and leave htaccess.txt as-is (not renamed to .htaccess). SEF URLs do not work, and default security rules are not active. Rename it to .htaccess immediately after installation.

3. Skipping updates: You postpone the Joomla 5.0.2 update because the site is working fine. A security vulnerability is discovered in 5.0.1, and your site gets hacked. Apply patch updates immediately.

4. Setting files to 777 everywhere: You set all files and folders to 777 because it fixes a permissions error. Now any compromised script on the server can modify your Joomla files. Use 755 for directories and 644 for files.

5. Not enabling 2FA for administrators: You rely solely on passwords for admin accounts. A password leak (phishing, reused password) gives an attacker full access to your site. Enable 2FA for every admin account.

Practice Questions

1. What is the single most important security practice for Joomla? Answer: Keeping Joomla core and all extensions updated. Most Joomla hacks exploit known vulnerabilities that have already been patched in newer versions. Regular updates prevent the majority of attacks.

2. What file permissions should configuration.php have in production? Answer: 444 (read-only for owner, group, and public). This prevents anyone from modifying the file, including the web server Process. The database credentials inside configuration.php remain safe even if another script is compromised.

3. How does Two-Factor Authentication protect admin accounts? Answer: 2FA requires a second factor (TOTP code from an authenticator app or biometric verification) in addition to the password. Even if an attacker steals or guesses the password, they cannot log in without the second factor.

4. Challenge: Perform a complete security hardening of a Joomla site. Rename htaccess.txt to .htaccess and add additional rules to block bad bots, set security headers, and restrict /administrator/ to your IP address. Enable 2FA on the Super User account. Check file integrity via Extensions > Manage > Check File Integrity. Set configuration.php to 444. Ensure all directories are 755 and files are 644. Verify the site still works correctly after all changes.

FAQ

Mini Project

Your task: Harden a Joomla site for production deployment.

1. Rename htaccess.txt to .htaccess and add: IndexIgnore, configuration.php protection, bad bot blocking, XSS protection headers, CSP header, and /administrator/ IP restriction.
2. Enable 2FA on all Super User accounts using Google Authenticator.
3. Update Joomla core to the latest version.
4. Update all installed extensions.
5. Set correct file permissions: configuration.php to 444, all directories to 755, all files to 644, tmp and log to 777.
6. Run file integrity check and verify all core files match.
7. Review the Security Center checklist and resolve all warnings.
8. Create a backup schedule: daily database backups, weekly full backups.
9. Subscribe to the Joomla Security Strike Team mailing list.
10. Document all security measures in a site security plan.

This project gives you a complete, production-ready security configuration that protects against the most common Joomla attacks.

What's Next

Now that your site is secure, you are ready to optimize performance:

Continue to Lesson 29: Caching — Learn how to configure system cache, page cache, browser cache, and Redis caching for Joomla.

Related lessons:

• Joomla Global Configuration — Review cache and error reporting settings
• Joomla Essential Extensions — Install Admin Tools for additional WAF protection