Security Checklist ?

[joomerguy]

Hello, Joomla People!

I am launching a Joomla 5 site soon. It is hosted with Scala Hosting. Presently in testing. I will likely launch multiple sites this year as well.

What essential security checks and precautions should I perform? I know some about web security and threats like XSS, DDoS (OWASP stuff) but I'm no expert. Are there anything particular to Joomla or CMS in general? Is there a checklist I can use for reference?

Thanks for any inputs!

[joomerguy]

I found these (thanks to Joomla and those involved):

https://docs.joomla.org/Special:MyLangu ... _Checklist

https://docs.joomla.org/Security_Checkl ... or_defaced

viewtopic.php?f=714&t=757645

[Webdongle]

Remember you have to be 'lucky' all the time but the hackers only once.

[joomerguy]

Remember you have to be 'lucky' all the time but the hackers only once.

Indeed, it's an assymetrical situation. Thanks for the docs!

[helpwithjoomla]

I'll add a few thoughts:

- Have a good backup strategy in place so you can restore the site if needed. Frequent backups are best.
- Use a Content Delivery Network.
- Consider a firewall service like Sucuri. They can also help clean a hacked site. Some hosts also provide firewalls.

[AMurray]

If you want further comprehensive security information, sign up for Mysites.guru.

It's a Swiss army knife of tools, but the primary feature is the security audit, which goes through your site with a fine-tooth comb and reports any potential security problems (either with your site's Joomla configuration/settings or potentially damaging issues (like hacking) and provides comprehensive details to fix the problems.

[Per Yngve Berg]

https://developer.joomla.org/security.html

Check the vulnerable extensions list.