Should I upgrade considering the custom work we have done?

[Austin1988]

Hi,

I am just after a little bit of advise please.

We have a website in Joomla 2.5 that we have spent several thousand pounds on and it is only just being released because of so many different custom components that we have had built.

Ideally we would release the website in Joomla 2.5 but I am aware of security and hacking risks that could occur from out of date software.

My question is, is it likely that I'll be able to keep my Joomla 2.5 site running without it getting hacked? If not, what sort of components are there to keep the site as secure as possible?

Many thanks!

[Bernard T]

From my years of experience with pro development and hosting of Joomla sites, I would boil it down to this general advice and considerations:

• find a decent, secure and responsive hosting provider, choose wisely. Without secure and up-to-date hosting environment - nothing else matters
• check your hosting provider's policies regarding security - do they scan the websites for malware for you, what else they do to insure your websites security?
• check your hosting provider's policies regarding critical situations protocols , and do they just lock you website down when you have the problem and leave you "dead in the water"
• user-isolated hosting enviroments, like VPS or dedicated servers are preferred
• mod_security and other proven app firewalls are advisable
• read (and learn) security articles and advisories: http://docs.joomla.org/Security
• update Joomla regularly and on time, subscribe to security announcements http://developer.joomla.org/security.html
• regularly check VEL - Vulnerable Extension List - http://vel.joomla.org/ and subscribe to notifications about new/resolved VE
• (re)check where you are getting any of the extensions or templates from. If it is not the original author's website or directly from JED, then make sure you download the original version again and replace all the files with original ones. That's especially valid if you downloaded from "warez" websites

Since you state that you have had several custom extensions developed

• ensure constant developers care of all custom extensions - not maintained extensions are mostly used "backdoors" for hackers
• (if your budget allows) order an PHP code audit for your custom code, provided by 3rd-pty PHP security professionals

[Austin1988]

Thank you. I'll have a look at your points when I get chance to go through them. Thanks again

[Bernard T]

No problem, anytime.

Btw. if it's not too late, and budget allows, upgrading to Joomla 3 would ensure longer core code (security) upgrades from Joomla developers team .