13 Tips for Better Joomla CMS Security

CIO - As Joomla grows in popularity as an open source CMS more and more individuals and businesses of all sizes rely on the platform to get their products and services online. In fact, more than 2.5 percent of websites are running on a Joomla CMS -- and for good reason.

Joomla is free and there are more 8,600 extensions that allows it to do almost anything you want a CMS to do. Add to that a robust developer community and you've got a compelling product. Being so popular it's no surprise that malicious hackers continue to find new and innovative ways to gain access to your data. With that in mind, here are ways you can prevent these attacks and strengthen the walls of your CMS.

There are all kinds of hacks and attacks that the bad guys can use to infiltrate or bring down your site. These range from remote file inclusion to cross site scripting to the ever-popular SQL injection. Making your site more secure and resilient is a full-time job. For the most part a properly configured instance of Joomla on a properly configured server is about as secure as any other off-the-shelf solution. So why is it that Joomla gets the rap that it's among the most vulnerable open source CMS projects? To answer that question you need only to look in the mirror.

An infrastructure is only as secure as its weakest link and as it turns out a vast majority of security issues related to Joomla are not caused by Joomla's core code. Most security issues stem from old unpatched versions of Joomla or insecure, out-of-date and poorly written third-party extensions.

As the admin you have the daunting task of ensuring your CMS is properly patched, updated and secure. To help you achieve this goal, we've compiled this list of things you can do to improve your Joomla security.

1. Servers and Hosting

No decision is going to be more critical than hosting and servers. Many a server errors can be attributed to unpatched servers, open ports or weak shared hosting. On shared hosting your site could be set up properly and still be hacked through another site on the shared server. If your current host has problems with basic server configurations than you should most likely look for a new host. So step 1 make sure you are using a well-known secure host and that you stay current with your server patches.

Host your site on a server that runs PHP 5.2 or better in CGI mode with Su_PHP. Su_PHP is to PHP scripts what Su_Exec is to Perl files; basically it allows the execution of scripts under your specific user account as opposed to default Apache account. This allows you to more easily identify and track security breaches.