Joomla security issues are worring everyone and especially whose Joomla site was hacked at least once. It is not enough just install security component like Defender, RS Firewall, X-Defender or whatever. All of them not capable to secure everything and have limitation though give quite good protection in some points.
So here is the steps you can implement that can save you from hacker attacks.
1 - Htaccess protection
Change .htaccess file in Jomla root. Add to .htaccess following code.
<Filesmatch ".(php)$"> order deny,allow deny from all </Filesmatch> <Filesmatch "^index.php"> order allow,deny allow from all </Filesmatch> <Filesmatch "^index2.php"> order deny,allow allow from all </Filesmatch>
This will prevent to execute any PHP file except index.php. So if hacker is lucky to upload backdoor on the server he cannot access it anyway.
But hacker can upload backdoor with name index.php and put to other folder and it will be accessible. Then you need to put .htaccess to all first level sub folders with this code.
<Files ~ ".(php)$">
Deny from all
</Files>
And this will prevent from running any PHP file directly.
In administrator directory you need following htaccess code
<Files ~ ".(php)$">
Deny from all
</Files>
htaccess protection is done.
2 - FTP Protection
You know that Joomla save FTP details in configuration.php. And it gives more access level if hacker read this file. SO we need to protect FTP service and allow FTP access only from particular IPs. Thus if hacker even gets FTP login information he cannot login to FTP. Here is example how you can do it with proftpd.
In /etc/proftpd.conf insert this code
<Limit LOGIN> Order allow,deny Allow from 11.22.33.44 Allow from 127.0.0.1 Deny from all </Limit>
Where 11.22.33.44 id the IP from allowed to login from. Do not forget to add there 127.0.0.1 of your server IP that Joomla through PHP could login to FTP to manage files.
3 - Block IPs
Next step to block some IPs or countries by IPs. To get correct IPs you can use this site.
You can do it with iptables. For that you need SSH. If you do not have it, then write to server admin and ask to do it for you or give you SSH access. Run this command line in shell.
/sbin/iptables -I INPUT -s 88.147.196.0/88.147.253.255 -j DROP
-I – Insert. You also can use –A append. You can block range separated by / or individual IP. Blok Iran, Iraq, …
4 - Files and folders
Next step to protect files and folders. Basically idea is all your files and folders should be reset to e owned by FTP user. Also folders to 755 and files to 644 permissions. If you have SSH the command will be like this.
Navigate to joomla root chown -R user:group ./ chmod -R 0644 ./ find . -type d -exec chmod 755 {} ;
If you do this, then folders and files will not be writable through PHP.
But you should make cache and backups folders 777 manually. Do not forget it.
5 - Install Defender v3
Install Defender v3 (aprox. release end of August 2009). This component will do the rest. As we protected any access but only through Joomla index.php now we can control what is going on.
Defender v3 is a next generation of Joomla Security component that should have all most recent and modern features of high quality. It will check your files and folders permissions, size, file versions, injections, flood, and many more…
Conclusion
With this 5 simple steps you can prevent 99.9% attacks.
on 
on 
on 
+996 (312) 689134, 
+1 (209) 800 1209