In the previous article, «Joomla vs WordPress Vulnerabilities: A Comparative Analysis and Statistics» we examined the situation regarding the rapid growth of data on discovered vulnerabilities in Joomla extensions and WordPress plugins. In this article, we will look at tips on what needs to be done to minimize the risks of hacking and mitigate the consequences of a breach. We will also look at typical sequences of actions that can help in recovering a website after a hack.
The proposed tips can be useful both for Joomla and WordPress websites and for websites on other CMS platforms. To a lesser extent, they will be useful for all other websites.
None of these tips, nor all of them combined, and any other tips for protecting a website from being hacked, provide a 100% guarantee. If you don't want your website to be hacked, you shouldn't have a website at all.
For the most part, the tips will specifically concern Joomla. They were formed based on working with this CMS since 2010. I am not a programmer and cannot independently analyze code and draw conclusions regarding its vulnerability or maliciousness. However, I have many years of quite successful practical experience in terms of increasing the protection of Joomla websites from hacking and restoring them after a breach.
The tips will be useful for webmasters, administrators, and website owners.
Video
- Tips on increasing website protection against hacking – 00:01:36.
- Tips on minimizing negative consequences in case of a hack – 00:07:53.
- Configuring «.htaccess» – 00:12:32.
- Website recovery after a hack (if there is a backup) – 00:14:39.
- Website recovery after a hack (if there is no backup) – 00:16:58.
Better watch video with «1080p HD» quality. This and other video overviews and tutorials can be found on my YouTube channel.
Links from the video:
- «Joomla vs WordPress Vulnerabilities: A Comparative Analysis and Statistics».
- Admin Tools.
- RSFirewall for Joomla.
- Akeeba Backup.
- Admin Tools Pro and Akeeba Backup Pro subscription.
- RSFirewall for WordPress.
Code from the video:
<FilesMatch "\.php$">
Order Allow,Deny
Deny from all
</FilesMatch>
<FilesMatch "^index(2|3)?\.php$">
Order Allow,Deny
Allow from all
</FilesMatch>
Options -Indexes -ExecCGI
<IfModule mod_include.c>
Options -Includes
</IfModule>
<IfModule mod_mime.c>
RemoveHandler .php .php3 .php4 .php5 .php7 .php8 .phtml .phar .phps .pl .py .sh .cgi
RemoveType .php .php3 .php4 .php5 .php7 .php8 .phtml .phar .phps .pl .py .sh .cgi
</IfModule>
<FilesMatch "(?i)\.(php[0-9]?|phtml|phar|phps|cgi|pl|py|sh|exe|asp|aspx)(\.|$)">
Require all denied
</FilesMatch>
<FilesMatch "(?i)^(\.htaccess|\.htpasswd|\.user\.ini|php\.ini|web\.config|composer\.(json|lock)|package(-lock)?\.json)$">
Require all denied
</FilesMatch>
<IfModule mod_headers.c>
Header set X-Content-Type-Options "nosniff"
</IfModule>
Website protection
Tips on increasing website protection against hacking.
- Completely remove any unused extensions and templates.
- Regularly update Joomla to the latest stable version.
- If you are using outdated extensions that have not been updated in a long time, try to find replacements for them.
- Timely update all installed components, modules, plugins, and templates.
- Use hosting with modern supported PHP versions, account isolation, and an antivirus scanner.
- Install and configure a specialized security extension (WAF), such as Admin Tools Pro or RSFirewall. If you wish, you can try using both extensions.
- Connect a cloud-based Web Application Firewall (WAF) at the DNS level, such as Cloudflare.
- Use strong passwords that you do not use anywhere else.
- Enable two-factor authentication (2FA) for Super User accounts. Alternatively, you can protect the admin folder using web server tools (via an «.htpasswd» file), which is HTTP Basic Auth. If possible, restrict access to the administrator panel by IP addresses.
- If possible, restrict access to FTP, phpMyAdmin, and the hosting control panel by IP addresses.
- Set correct file system permissions: 755 for folders, 644 for files, and 444 for «php».
- Use exclusively SFTP or SSH for access to the server file system, avoiding regular FTP.
- Disable potentially dangerous functions in PHP settings (for example, allow_url_fopen, exec, shell_exec, system).
- Ensure the website operates exclusively via the secure HTTPS protocol.
- Change the standard login URL for the site's administration panel. For example, using Admin Tools Pro or RSFirewall.
- Block directory listing at the web server level or within the «.htaccess» file.
- Prohibit the execution of PHP scripts in upload directories (for example, «/images/») using «.htaccess» or Nginx configuration.
- Configure strict HTTP security headers (Content Security Policy, X-Frame-Options, HSTS, X-Content-Type-Options). Joomla has a dedicated plugin for this.
- Limit the number of login attempts to the admin panel to protect against brute-force attacks. You can add a captcha.
- For example, using RSFirewall.
- Disable the new user registration feature if it is not required by the project's logic.
- Ensure strict antivirus control and regular updates of the OS and software on the devices of all site administrators.
Tips on minimizing negative consequences in case of a hack.
- Set up regular automated creation of full website and database backups (for example, using Akeeba Backup). Set up automatic uploading of backups to remote cloud storage that is not physically connected to the website hosting, such as Google Drive.
- Keep backup archives for several different periods (for example, for the past few days, weeks, and months).
- Periodically perform a test website restoration from a backup on a local server to ensure the archive is working properly.
- Host each website on a separate hosting account to avoid cross-contamination of neighboring projects.
- Implement a File Integrity Monitoring system to instantly detect unauthorized changes in the code.
- Connect an uptime monitoring system.
- Add the website to Google Search Console to receive notifications if malware is detected by the search engine, though this may happen with a delay.
- Keep local «clean» copies of your custom templates, scripts, and code modifications.
- Enable the built-in Joomla «Action Logs» plugin to track activity in the admin panel.
- Keep only one account with Super User rights active, or minimize their number.
- Configure the retention of web server logs («log» and «error.log») for an extended period to enable incident investigation.
- Prepare a step-by-step incident response plan in advance so you can act without panic in the event of a breach.
Website Recovery
Let's consider the general sequence of actions that can be taken as a basis when restoring a website after a hack. For each individual case, this sequence may vary. I offer two sequences: for the situation when you have an up-to-date and «clean» website backup, and when you do not. Neither sequence guarantees that the website will be restored without issues and that no malicious or vulnerable files will remain on it.
Website recovery after a hack (if there is a backup).
- Close access to the website for visitors via the «.htaccess» file or the hosting control panel.
- Create a backup of the current (hacked) state of files and the database to preserve evidence and for further analysis.
- Change access passwords for the hosting control panel, FTP/SFTP, SSH, and the database user.
- Delete absolutely all website files and folders from your server.
- Completely clean the database (delete all existing tables).
- Restore files and the database from the most recent «clean» backup created before the potential hack.
- Immediately update the Joomla core, as well as all installed components, modules, plugins, and templates to the latest current versions.
- Check the «#__users» table in the database for hidden or unknown accounts with Super User rights and delete them.
- Check the contents of the «configuration.php», «index.php» (in the site root and the root of every template, including admin templates), and «.htaccess» files for malicious code by comparing them with the originals.
- Scan the restored website directory with a server antivirus or a specialized scanner script.
- Change the passwords again for all Super User accounts within Joomla itself.
- Install and configure a security component (WAF) if it was not installed previously. For example, Admin Tools Pro or RSFirewall.
- Open public access to the website.
- Clear the Joomla cache, as well as server-level or CDN cache (for example, Cloudflare).
- Submit a review request for the resource in Google Search Console if the site was flagged as dangerous by the search engine.
Website recovery after a hack (if there is no backup).
- Close access to the website for visitors via the «.htaccess» file or the hosting control panel.
- Create a backup of the current (hacked) state of files and the database to preserve evidence and for further analysis.
- Change access passwords for the hosting control panel, FTP/SFTP, SSH, and the database user.
- Download the official archive of your current Joomla version and overwrite all system files on top of the existing ones.
- Overwrite the files of all installed third-party components, modules, plugins, and templates with clean copies from official distributions.
- Clean out third-party code from «configuration.php», the root «index.php», the «index.php» of all templates including admin templates, and «.htaccess».
- Find and delete all files with a «.php» extension in the «images», «files», «tmp», «cache», «logs», «administrator/cache», and «administrator/logs» directories.
- Check the «#__users» table in the database and delete all unknown accounts with Super User rights.
- Analyze content tables in the database for malicious «iframes», scripts, or spam links.
- Scan the file system with a server antivirus to search for hidden web shells and backdoors.
- Update the Joomla core and all extensions to the latest current versions.
- Change the passwords again for all legitimate Super User accounts within Joomla itself.
- Open public access to the website and submit it for review in Google Search Console.
I will emphasize once again that none of these tips, nor even all of them combined, and any other tips on website protection against hacking, provide a 100% guarantee.
I hope this video helped you improve your website's protection against hacking, minimize negative consequences, and recover it in the event of a hack or failure.
To generate the article's image, the Nano Banana 2 Pro model was used.
Gemini 3.1 Pro (Expanded thinking) was used in writing the article to translate the texts from the previous series of articles on website security, reformulate sentences, and check spelling.
| Article author – Aleksej Khoroshevskij |
|---|
 Ph.D., lecturer at Kharkiv National University of Radio Electronics, web developer, and SEO specialist with over 15 years of experience. Expert in website creation using Joomla and WebSite X5. Author of scientific publications, video courses, and educational content on web development and SEO. Runs a blog and a YouTube channel, sharing knowledge and practical experience. Provides services in website development, customization, maintenance, and promotion. Learn more about the author… Publications and work: |
| Similar articles |
|---|
Useful links:
