View source for Security Checklist/Joomla! Setup

===Running on a non-vhost environment===
When you are running Joomla on a non-vhost environment please make sure that you set the <code>live_site</code> setting within the configruation.php to your domain in order to protect you against potential '''Host Header Injection'''. All sites that are running within an vhost setup are not affected by this issue.

<translate>===Avoid shared servers if possible=== <!--T:51--></translate>
: <translate><!--T:52--> For maximum security, avoid a shared server on which you don't know or can't trust all the other users or their code quality.</translate>

<translate>===Enable SSL on your server=== <!--T:53--></translate>
: <translate><!--T:55--> Servers with SSL correctly configured are currently the only way to securely process confidential transactions and secure user authentication. SSL works by encrypting all HTTP communications between the Web server and Web clients. Thus, even if a transmission is intercepted, it cannot be read. For more information read our [[Enabling_HTTPS_on_your_site|dedicated article]] in this Security Checklist (if you haven't already)</translate> 

: <translate><!--T:56--> Joomla! 1.0.x does not allow you to assign an SSL server to individual sub-directories. Search the forums for "Tommy Hack" for one way to deal with this. Joomla! 1.5 and higher supports configuration of SSL options out of the box.</translate>

<translate>===Use Apache's .htaccess=== <!--T:57--></translate>
: <translate><!--T:58--> For an additional layer of password protection, you can use .htaccess to password protect critical  directories. This is usually adequate for blocking the typical script kiddie, but be aware that .htaccess password protection alone is not a highly secure method. It MUST be combined with an SSL server for maximum protection. An SSL server is required for protecting your site from more sophisticated attacks, such as packet sniffing.</translate>

<translate>===Switch to Joomla! 3.x=== <!--T:59--></translate>
{{JVer|3.0}} <translate><!--T:60--> The most significant upgrade in Joomla!'s history includes powerful security and performance enhancements.</translate>
* [[Why_Migrate|<translate><!--T:61--> Why Migrate?</translate>]]
* [https://downloads.joomla.org/cms Joomla Downloads]

<translate>=== Add Joomla! Security Announcements to your site === <!--T:62--></translate>
: <translate><!--T:63--> The Joomla! Security Team supports and RSS feed that provides the latest Joomla security information. The following FAQ explains how to add this feed to your site.</translate>

* [[Security_and_Performance_FAQs#How_can_I_add_the_Joomla.21_Security_Announcements_Feed_to_the_Admin_Control_Panel%3F| <translate><!--T:64--> How can I add the Joomla! Security Announcements Feed to the Admin Control Panel?</translate>]]

<!-- KEEP THIS AT THE END OF THE PAGE -->
[[Category:Security Checklist{{#translation:}}]]