DE EN
Security · Hardening · 12 points

Joomla Security: Checklist 2026

As of: 20.07.2026 · Reading time ~12 min

Why this checklist

More than 80 % of all hacked Joomla sites are not compromised via the Joomla core, but through outdated components, weak admin passwords and misconfigured .htaccess files. This checklist summarises the 12 most important measures for Joomla 4, 5 and 6.

1. Keep Joomla up to date

Apply security updates within 24 hours. Joomla publishes security advisories via the official Security Centre page. Use a multi-site tool like UpdateKing if you manage more than 3 sites; manual tracking does not scale.

2. Reduce and review extensions

Every installed component is a potential vulnerability. Clean up:

  • Fully uninstall all unused components, modules and plugins (do not just disable them)
  • Install extensions only from the official Joomla Extension Directory or directly from the vendor
  • At every update, check whether the component is still actively maintained (last release < 6 months)

3. Secure the super user account

  • Never use the default username "admin" or "administrator"
  • Password: at least 20 characters, generated with a password manager (Bitwarden, 1Password)
  • One dedicated super user account per person, no shared logins
  • Remove inactive admin accounts immediately, do not just lock them

4. Enforce two-factor authentication (2FA)

Joomla 4+ ships with 2FA out of the box. Enable it under: System → Multi-Factor Authentication. Recommendation: TOTP (Google Authenticator, Authy, Bitwarden Authenticator) instead of SMS, because SIM swapping is real. UpdateKing enforces 2FA for all accounts by default.

5. Obscure the backend URL

By default everyone can reach the Joomla backend at /administrator. With extensions like Akeeba Admin Tools or a server-side .htaccess rule, the path can be renamed or restricted via IP whitelist. Reduces brute-force attacks by 90 %, but offers no real protection, only noise reduction.

6. Harden .htaccess

Joomla ships with a htaccess.txt file, which must be renamed to .htaccess. In addition, enable:

  • Block known bad bots (e. g. SemrushBot, AhrefsBot if undesired)
  • Block direct PHP calls in /images/, /templates/, /media/
  • HSTS header to enforce HTTPS: Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  • X-Frame-Options: DENY against clickjacking

7. Change the database prefix

The default is jos_ or j25_. For a fresh install choose a random prefix (e. g. k4n_). This makes SQL injection attacks much harder, because generic exploit scripts do not hit the table names directly.

8. File and folder permissions

Standard on production servers:

  • Folders: 755 (rwxr-xr-x)
  • Files: 644 (rw-r--r--)
  • configuration.php: 444 or 400 (read-only)

Never set 777 permanently, not even for upload directories. If there are hosting problems, check ownership instead of weakening permissions.

9. SSL/TLS and mixed content

Joomla → System → Configuration → Server → "Force SSL" set to Entire Site. Then test with SSL Labs. Target: grade A or A+. Disable TLS 1.0 and 1.1, allow only TLS 1.2+.

10. 3-2-1 backup strategy

3 copies, 2 different media, 1 off-site. Specifically for Joomla:

  • Daily Akeeba backup to the web server
  • Weekly backup to an external S3 bucket or Backblaze
  • Monthly cold backup to a separate external hard drive

Important: test the restore at least once per quarter. An untested backup is not a backup.

11. Monitoring & alerts

  • Uptime check every 60 seconds (UptimeRobot, Better Stack, or integrated in UpdateKing)
  • File integrity monitoring, e. g. with the Akeeba Admin Tools hash database
  • Login alerts via email on every super user login
  • 404 spike detection: a sudden multiplication indicates scan attacks

12. Document an incident response plan

If a site does get compromised, every minute counts. Document in advance:

  • Who has access to which hosting account?
  • Where is the last clean backup stored?
  • Which order: take the site offline → rotate passwords → forensics → restore
  • Who is the data protection officer (GDPR notification duty within 72 hours)

Summary

Security is not a project, it is an ongoing process. Anyone managing several Joomla sites cannot do this without tooling. UpdateKing automates exactly the maintenance parts of this checklist that consume the most time manually: update status, logs, reports, 2FA, monitoring.

Start for free: The first Joomla site is permanently free in the Starter plan. No trial, no credit card. Create account →

Further reading: Joomla Update Guide 2026 · Joomla maintenance for multiple sites · Joomla Update Manager