If you have just installed Joomla 1.5, congratulations. You now have a powerful CMS at your disposal. But before you start building out your site, there are several steps you should take to lock things down. A default Joomla installation is functional, but it is not secure out of the box.

This guide covers the fundamental hardening steps every Joomla administrator should complete immediately after installation.

1. Remove the Installation Directory

This one is obvious, but it still catches people off guard. Joomla will actually warn you about this on the admin dashboard, but I have seen live sites where the /installation/ directory was still sitting there weeks later.

Delete it. Do not rename it. Delete it entirely.

rm -rf /path/to/joomla/installation/

If you are on shared hosting without SSH access, use your file manager in cPanel to remove it.

2. Change the Default Database Table Prefix

During installation, Joomla lets you set a table prefix. The default is jos_. Every automated SQL injection tool on the internet knows this. If an attacker finds an injection point in a poorly coded extension, having a non-default prefix adds one more obstacle.

If you already installed with the default prefix, you can change it, but you need to rename every table in your database and update configuration.php to match. For a fresh install, just pick something random like x8k_ during setup.

In your configuration.php, the relevant line looks like this:

var $dbprefix = 'x8k_';

3. Set Proper File Permissions

File permissions are one of the most overlooked security measures on shared hosting. Here is what you should aim for:

  • Directories: 755
  • Files: 644
  • configuration.php: 444 (read-only for everyone)

You can set these via SSH:

find /path/to/joomla/ -type d -exec chmod 755 {} \;
find /path/to/joomla/ -type f -exec chmod 644 {} \;
chmod 444 /path/to/joomla/configuration.php

The key point with configuration.php is that it contains your database credentials in plain text. Making it read-only prevents a compromised extension from overwriting it.

4. Disable the FTP Layer

Joomla 1.5 includes a built-in FTP layer that was designed to work around file permission issues on shared hosting. The problem is that it stores your FTP username and password in configuration.php - in plain text.

Unless you absolutely need this feature because your host has restrictive file ownership settings, disable it. Go to Global Configuration > Server > FTP Settings and set “Enable FTP” to No.

If your hosting environment requires the FTP layer for file uploads to work, talk to your host about fixing the underlying permission issue instead.

5. Protect the Administrator Directory

The default admin URL for Joomla is /administrator/. Every bot and script kiddie knows this. While you cannot easily rename this directory without breaking things, you can add an extra layer of protection.

The simplest approach is HTTP authentication. Create an .htpasswd file and add a .htaccess rule to your /administrator/ directory:

AuthType Basic
AuthName "Restricted Area"
AuthUserFile /path/outside/webroot/.htpasswd
Require valid-user

This gives you a second login prompt before anyone even reaches the Joomla admin login page.

6. Keep Joomla Updated

This should go without saying, but the number of sites running outdated Joomla versions is staggering. Subscribe to the Joomla Security Strike Team announcements. When a security release comes out, apply it promptly.

Joomla 1.5 uses a patch-based update system. You download the update package, extract it over your existing installation, and run the update script. It takes five minutes and it could save you from a serious compromise.

Check your current version at Help > System Info in the admin panel.

7. Review Global Configuration Settings

A few settings in Global Configuration deserve attention:

  • Error Reporting: Set to “None” on production sites. PHP error messages can leak path information and other details useful to attackers.
  • Session Lifetime: The default of 15 minutes is reasonable. Do not set it excessively high.
  • Force SSL: If you have an SSL certificate, enable this for the administrator area at minimum.

Wrapping Up

None of these steps are difficult. Each one takes a few minutes at most. But together, they significantly reduce your attack surface. A hardened Joomla installation is not impenetrable, but it is a much less attractive target than one running with all the defaults.

In future posts, we will look at extension security auditing and more advanced .htaccess rules. For now, get these basics in place and you will be ahead of most Joomla administrators out there.