mat

Hi guys. I have had my Joomla sites hacked quite a few times now and decided tonight to take some action. This may be helpful for quite a few of you, although it is a well known technique.

The idea is to move the configuration out of the public_html folder to stop most hacking attempts. Most hackers rely on the fact that your config file will be located in the standard Joomla structure. If it is then you are leaving yourself open to this kind of attack...

Step by step:

1) Backup your configuration.php

2) FTP to your Joomla Website

3) Create a new folder outside of your public_html where you will put

your configuration.php. Call it what you want.

4) Move your configuration.php file to your new folder outside of the public_html

5) Rename it to something new, for example "yourwebsitenameconfig.php" This also helps tell it apart if you will be placing more than one joomla config in this area.

6) Create a new blank configuration.php in your editor or notepad, which will be uploaded to the joomla site directory to replace what you have just moved.

Put the following code into it with no empty lines above or below:


<?php
require( '/home/xxxxxx/YOURNEWFOLDER/yourwebsitenameconfig.php' );
?>


Ofcourse replace the above x's, folder name and config name with your server path and directory names. This file is basicly telling your site where to find the config file you have moved outside the public_html.


6) Save it and upload it to your Joomla site where the original config file was.

7) Now change your new config file privileges to 444.


Refresh your site and hope its all still working

__________________
Mathew.co.uk - Follow me on Twitter here