Best Way to Protect Joomla Backend !!!

Zabra · 08-18-2011, 01:50 PM

What are the best ways of protecting the backend access of website made using Joomla.??

blowdoof · 08-19-2011, 03:48 PM

hide it, move it and/or protect the admin folder it with a directory protection, and always use strong passwords + change them on a regular base

Zabra · 08-20-2011, 09:43 AM

(08-19-2011, 03:48 PM)blowdoof Wrote: hide it, move it and/or protect the admin folder it with a directory protection, and always use strong passwords + change them on a regular base

Thanks ..
But If you can get to the administrator ID (eg. default is 62 ) then hiding or moving the directory wont make a difference.... will it??

blowdoof · 08-20-2011, 10:57 AM

nobody says you have to keep that default admin with id 62. Make sure when you're not in need of frontend login, you disable those plugins + login module + registration options.... If you don't show a door it's harder to open it

Zabra · 08-20-2011, 12:15 PM

Ok thats fyn ...:heh::thumbs:
what I meant was if supposing I do change the admin Id .. But If someone knows the new Id then they can hack in ryt ...
[The ID can be determined easily using even lame brute force...]

And The website need constant updating of Data so I cant really disable those plugins ... It'll be a pain in the ass enabling and disabling dem each and every time.:rip:

blowdoof · 08-20-2011, 03:00 PM

even when disabling login, you can still access the backend. Disable all the things you don't need.. so if you don't require frontend login, disable at least that. Besides, the passwords in joomla are stored with md5 + random salt, hard to crack even if given the entire md5 hash. One more thing, keep it patched ! Security holes are quickly patched, but also visible to everyone. If you didn't patch your site on a regular base, you make it easier for the possible hacker. Most patches released lately are minor issues however.

Zabra · 08-21-2011, 09:55 AM

(08-20-2011, 03:00 PM)blowdoof Wrote: even when disabling login, you can still access the backend. Disable all the things you don't need.. so if you don't require frontend login, disable at least that. Besides, the passwords in joomla are stored with md5 + random salt, hard to crack even if given the entire md5 hash. One more thing, keep it patched ! Security holes are quickly patched, but also visible to everyone. If you didn't patch your site on a regular base, you make it easier for the possible hacker. Most patches released lately are minor issues however.

How can I do that ..?

I mean access the backend if the login is disabled..?/^_^'^_^'

Do you mean from the control panel directly editing the source codes..???