Change your Joomla Admin Folder Name or Path
This may help limit issues for joomla security in the future.
- Create a new directory in your root directory (eg. "myadmin")
- Create an index.php file in your "myadmin" directory..
$admin_cookie_code="1234567890";
setcookie("JoomlaAdminSession",$admin_cookie_code,0,"/");
header("Location: /administrator/index.php");
?> - Add this to .htaccess of your real Joomla administrator directory
RewriteEngine OnTo enter your Joomla administration page, you point your browser to "http://yoursite.com/myadmin/" The php code will set a cookie that expires at the end of the session and redirect you to your real administration page. No one will be able to load anything from the administrator directory without having gone through the "myadmin" directory first.
RewriteCond %{REQUEST_URI} ^/administrator
RewriteCond %{HTTP_COOKIE} !JoomlaAdminSession=1234567890
RewriteRule .* - [L,F]
Needless to say, you would choose another directory name for "myadmin" and change the cookie code "1234567890" to something else. Security through obfuscation is no substitute for the real thing but this might make you feel a little better.
joomlaservices
joomlaservices
394295112
joomlaservices
+91-9853790816
joomlaservices
Comments
correct me if i`m wrong:
1)
index.php file in your "myadmin" directory should be:
header("Location: ../administrator/index.php");
and not:
header("Location: /administrator/index.php");
2)
if i have windows i have to create a text file (lets say htaccess.text )
and then rename the file htaccess.text i created to .htaccess by
start => run => cmd //this will bring me to command prompt
and then
ren C:\wamp\www\YOUR_SITE_FOLDER_NAME\administrator\htaccess.txt .htaccess
when i did this it really prevented access to the http://localhost/YOUR_SITE_FOLDER_NAME/administrator folder
*BUT* i got rejected also when i first went to the new folder where i set the cookie
http://localhost/YOUR_SITE_FOLDER_NAME/NEW_ADMIN_FOLDER = >>> gave same result
is the next line ok?
RewriteCond %{HTTP_COOKIE} !JoomlaAdminSess ion=1234567890
RewriteRule .* - [L,F]
(btw my JoomlaAdminSess ion is the same)
my solution was to check for COOKIE value on the administrator folder index.php :
if ($_COOKIE['JoomlaAdminSess ion'] != "1234567890")
{
header("Location: ../index.php");
}
is this solution ok or it has security hole?
and where is the mistake here:
RewriteCond %{HTTP_COOKIE} !JoomlaAdminSess ion=1234567890
RewriteRule .* - [L,F]
?