CMS Joomla Help

Joomla Security Hardening Checklist

Work through these to harden your Joomla site. Your progress is saved in this browser. Tools that help are linked where relevant.

0%

Keep things current Running a supported Joomla version (see the version tool) Running a supported, current PHP version All extensions, templates and plugins updated Removed unused extensions, templates and plugins

Access & accounts Strong, unique Super User password Two-Factor Authentication enabled for admins Default "admin" username changed to something else Limited number of Super User accounts

Server & files Files set to 644 and folders to 755 (never 777) configuration.php set to 444 (read-only) Site forced to HTTPS Directory browsing disabled in .htaccess Non-default database table prefix in use

Operations Error reporting set to "None"/"System Default" on production Regular, tested off-site backups (e.g. Akeeba) A Web Application Firewall / security extension installed Admin area protected (IP allowlist or extra password)

A starting point, not a guarantee — based on common Joomla hardening guidance. Related tools: chmod calculator, version compatibility, .htaccess generator.

CMS Joomla Help

Free tutorials, troubleshooting guides and tools for Joomla site owners. Not affiliated with the Joomla! Project or Open Source Matters, Inc.