The .htaccess file is one of the most powerful tools available for securing a Joomla site running on Apache. It sits in your web root and controls how the server handles requests before they ever reach PHP. With the right rules, you can block entire classes of attacks at the server level.

Here is a collection of practical .htaccess rules I use on every Joomla installation I manage. Each one addresses a specific threat.

Protect configuration.php

Your configuration.php file contains database credentials, secret keys, and other sensitive settings. Nobody should be able to request it directly through a browser. Add this rule:

<FilesMatch "configuration.php">
    Order Allow,Deny
    Deny from all
</FilesMatch>

Even though PHP normally processes this file and does not output its contents, there are edge cases - like a server misconfiguration or a PHP crash - where the raw source could be exposed. This rule makes sure Apache blocks the request entirely.

Disable Directory Listing

By default, if Apache cannot find an index file in a directory, it will display a listing of all files. This gives attackers a map of your file structure. Disable it:

Options -Indexes

One line. Put it near the top of your .htaccess. This should be standard practice on every web server, not just Joomla.

Block Access to Sensitive File Types

There are several file types that should never be served to visitors. XML configuration files, SQL dumps, log files, and the htaccess file itself:

<FilesMatch "\.(htaccess|htpasswd|ini|log|sh|sql|bak|config|dist|inc|orig|tmp)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

I have seen sites where a developer left a database.sql backup in the web root. Without this rule, anyone could download it.

Restrict Administrator Access by IP

If you have a static IP address, you can lock down the entire /administrator/ directory to only allow access from your IP. Create a separate .htaccess file inside /administrator/:

Order Deny,Allow
Deny from all
Allow from 203.0.113.50

Replace 203.0.113.50 with your actual IP. If you work from multiple locations, add additional Allow from lines.

This is the single most effective way to protect your admin panel. Even if an attacker has valid credentials, they cannot reach the login page from a different IP.

Block Common Exploit Patterns

Many automated attacks use predictable URL patterns. You can block them with mod_rewrite rules. Add these inside a <IfModule mod_rewrite.c> block:

RewriteEngine On

# Block common SQL injection patterns
RewriteCond %{QUERY_STRING} (union|select|insert|drop|delete|update|concat|char\() [NC]
RewriteRule .* - [F,L]

# Block base64 encoded injections
RewriteCond %{QUERY_STRING} base64_encode [NC]
RewriteRule .* - [F,L]

# Block script tags in URL
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule .* - [F,L]

A few notes on these rules. The SQL keyword filter is aggressive - it will block any URL containing words like “select” or “union” in the query string. If you have a legitimate component that uses these words in URLs (unlikely but possible), you may need to add exceptions. The GLOBALS and _REQUEST rules block a well-known Joomla attack vector where attackers try to overwrite PHP superglobals.

Block Bad User Agents

Many attack tools identify themselves with known user agent strings. While a serious attacker will fake their user agent, blocking the common ones filters out noise:

RewriteCond %{HTTP_USER_AGENT} (libwww-perl|wget|python|nikto|curl|scan|java|winhttp|clshttp|loader) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC]
RewriteRule .* - [F,L]

Be careful with the curl entry. If you use curl for legitimate server-side operations, remove it from the list.

Prevent PHP Execution in Upload Directories

Joomla’s /images/ and /media/ directories should never execute PHP. If an attacker manages to upload a PHP shell through a vulnerable extension, this rule prevents it from running:

<Directory "/path/to/joomla/images">
    <FilesMatch "\.php$">
        Order Allow,Deny
        Deny from all
    </FilesMatch>
</Directory>

Note that <Directory> directives do not work in .htaccess files - they require the main server configuration or a VirtualHost block. For .htaccess, place a separate file inside the /images/ directory:

<FilesMatch "\.php$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

Do the same for /media/ and /tmp/.

Putting It Together

Do not just copy and paste all of these rules at once. Add them one at a time and test your site after each addition. A misconfigured .htaccess can break your site or lock you out of the admin panel.

Keep a backup of your working .htaccess before making changes. If something goes wrong, you can restore it via FTP or your hosting file manager.

These rules are not a replacement for keeping Joomla and its extensions updated. They are an additional layer of defense that catches many common attacks before they reach your application code.