View source

{{RightTOC}}
== Read Me First==

=== Security is always a concern ===

:On the Internet, security is a fast evolving and ever present challenge. There is no one right way to secure a site, and all security methods are subject to improvement, revision, and obsolescence at any time. Luckily, there are many well-established principles that can help. The following checklist points you toward current best practices for Joomla security.

=== The most important guidelines===
:This checklist is long because the full plot is thick and complex. But don't despair! Here are the essential guidelines for securing any Web site. Following these few pointers will protect your site from most catastrophes.

# '''Backup Early and Often:''' Setup (and use and test!) a regular backup and recovery process. When done well, this one practice ensures that you can recover from almost any imaginable disaster.
# '''Update Early and Often:''' Promptly update to the latest ''stable'' version of Joomla! and any installed third-party extensions. This one step ensures that your site is protected from all new vulnerabilities as soon as a fix is released, and from all new attacks methods as soon as a defense is developed. 
# '''Use a secure host''' Of course the above advise applies to your entire infrastructure. Proper Web security is largely a Web hosting issue. Therefore, if security matters to you, use a high-quality Web host. Consider hiring professional assistance if you have no experience or knowledge in this area. If you wish to ask questions of the community regarding security issues, please do so using the appropriate board (ex., Installation, Migration and Updating, Administration, etc) in the [http://forum.joomla.org Joomla! Forums].

:There are many other important security considerations that you can learn about in this checklist and in the Security FAQ's.

==There is no Web security!==
===There's no free lunch!=== 

: Don't be fooled by Joomla's award winning ease-of-use. Maintaining a secure Web site on the open Internet is not easy. Adequate security requires a range skills and knowledge, constant watchfulness, and a very solid backup and recovery process.

===There's no one right way!===

: Due to the variety and complexity of modern web systems, security issues can't be resolved with simple, one-size-fits-all solutions. You (or someone you trust) must learn enough about your server infrastructure to make valid security decisions. Strong security is a moving target. Today's expert might be tomorrow's victim. Welcome to the game...

===There's no substitute for experience!=== 

: To secure your Web site, you must gain real experience (some of which will be bitter), or get experienced help from others. If you haven't invested the considerable time it takes to learn how to maintain a secure Web site, be sure you can consult with someone who has. Read this tongue-in-cheek description of the [[Top_10_Stupidest_Administrator_Tricks|Top 10 Stupidest Administrator Tricks]] which illustrates typical, blow-by-blow examples of how to learn Web security the hard way.

==Encouragements==

===Start at the head of the herd=== 

: The Security Forums are filled with "Help! I've been hacked" posts by people who did NOT follow standard security practices. If you decided to study this checklist before your site is attacked, congratulation, you're already ahead of the herd.

===It's not as hard as it looks===

: If this is one of your first Web sites, security considerations may seem intimidating, but you don't have to deal with all of it at once. As you become familiar with tools of modern Open Source Web development, such as [http://www.gnu.org/ GNU/Linux], [http://www.apache.org Apache], [http://www.mysql.com MySQL], [http://en.wikipedia.org/wiki/SQL SQL], [http://www.php.net PHP], [http://en.wikipedia.org/wiki/HTTP HTTP], [http://en.wikipedia.org/wiki/CSS CSS], [http://en.wikipedia.org/wiki/XML XML], [http://en.wikipedia.org/wiki/RSS RSS], [http://en.wikipedia.org/wiki/TCP/IP TCP/IP], [http://en.wikipedia.org/wiki/FTP FTP], [http://subversion.tigris.org/ Subversion], [http://en.wikipedia.org/wiki/JavaScript JavaScript], [http://www.joomla.org Joomla!], you'll add refinements to your set of security tactics.

=== How to get help ===
:If you believe your Web site was attacked, '''do not''' post in the Joomla! forums. If there is a vulnerability, publishing that information could put other Web sites at risk. Instead, report possible security vulnerabilities to the [http://developer.joomla.org/security/contact-the-team.html Joomla! Security Task Force].

=== How to read these documents ===
#Not all techniques are appropriate for every level of user. Apply the techniques you understand and read up on the ones you don't.
#Not all techniques are appropriate for every server. If you use a shared server, you will need to depend on the settings established by your hosting provider. If you are using a virtual or dedicated server, you will be able to apply more creative and exotic techniques.
#Not all techniques are appropriate for all Joomla! versions. Where a technique applies to only one version, an image is added, such as [[Image:Compat_10.png]] or [[Image:Compat_15.png]].

== Getting Started ==



===Are you ready?===

# Can you administer a dynamic, 24x7, world-accessible, database-driven, interactive, user-authenticated web server? 
# Do you have the time and resources to respond to the flow of emerging Internet security issues? The [[Top 10 Stupidest Administrator Tricks]] is a comic/tragic look at what can go wrong. Don't learn these tricks the hard way! Depending on your recent experience, reading the ''Stupidest Tricks'' will either make you laugh or cry.

===Stay informed of security issues===

: Given the complexity of web servers, new vulnerabilities and conflicts are discovered all the time. To receive all security announcements, just subscribe to Joomla Security News. There are several ways to subscribe: 
# [http://feedburner.google.com/fb/a/mailverify?uri=JoomlaSecurityNews Automatic Email Notification]
# [http://feeds.joomla.org/JoomlaSecurityNews RSS feed].

===Check the FAQs.===

: The most helpful posts in the Joomla! Security Forum are converted into [[Security and Performance FAQs]]. Many of the items on this list are explained in much greater detail in the FAQs.

===Learn from the pros===

: Read the excellent [[Beginners|Absolute Beginners Guide to Joomla!]] It has wealth of tips and tricks presented in an easy to understand format. Even experienced Joomlaists find great ideas here.

: Hunt down the many nuggets of wisdom found in the [http://forum.joomla.org Joomla! Forums], in particular the [http://forum.joomla.org/viewforum.php?f=432 Joomla! 1.5 Security Forum] and the [http://forum.joomla.org/viewforum.php?f=267 Joomla! 1.0 Security Forum].

== Security Checklists Table of Contents==
# [[Security Checklist 1 - Getting Started|Getting Started]] 
# [[Security Checklist 2 - Hosting and Server Setup|Hosting and Server Setup]]
# [[Security Checklist 3 - Testing and Development|Testing and Development]]
# [[Security Checklist 4 - Joomla Setup|Joomla Setup]]
# [[Security Checklist 5 - Site Administration|Site Administration]]
# [[Security Checklist 6 - Site Recovery|Site Recovery]]

<!-- KEEP THIS AT THE END OF THE PAGE -->
[[Category:Security Checklist]]