Secure Joomla Files and Directories (Best Practices)

Affiliate disclosure: This post contains affiliate links (including MonsterONE / Envato). If you buy through them, we may earn a commission at no extra cost to you. Full disclosure.

What you'll need	Notes
Joomla admin access	To update the Global Configuration server paths in Step 5
FTP/SFTP or hosting file manager	To edit permissions and .htaccess files
SSH access (optional but recommended)	For the find commands in Step 1
A recent full backup	Before changing permissions or .htaccess rules on a live site

Even if your Joomla core and installed extensions are fully patched, loose file permissions or an exposed folder can still let an attacker in. This guide walks through the file-and-directory hardening steps every Joomla site should have in place, tested against Joomla 6.1.x and 5.4.x (LTS).

🖼️ [IMAGE NEEDED — HERO] Wide illustrative shot of a Joomla file manager or SFTP client showing a directory tree with permission columns visible (755 for folders, 644 for files).

Step 1: Set Correct File and Folder Permissions

Incorrect permissions are one of the most common reasons Joomla sites get compromised. Use this baseline:

Type	Recommended	Why
📁 Directories	755	Owner can read/write/execute; group and others can read/execute only
📄 Files	644	Owner can read/write; group and others can read only
🚫 Never use	777	Grants full read/write/execute to everyone, including attackers

To apply this via SSH from your Joomla root:

find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;

Step 2: Protect the Configuration File

configuration.php stores your database credentials and site paths in plain text. Block direct HTTP access to it by adding this to your root .htaccess:

<Files configuration.php>
Order allow,deny
Deny from all
</Files>

🖼️ [IMAGE NEEDED — STEP 2] Screenshot of the root .htaccess file open in a code editor, with the <Files configuration.php> block highlighted/boxed in red.

Step 3: Disable Directory Browsing

If directory listing is on, anyone can browse your folder structure by visiting a directory URL directly — a free map for attackers. Disable it by adding this single line to your .htaccess:

Options -Indexes

Step 4: Restrict Access to Sensitive Folders

Folders such as /administrator, /logs, and Joomla's internal library/includes paths shouldn't be reachable by casual visitors. On an Apache setup with access to the main server config (not just per-directory .htaccess), you can block a folder like this:

<Directory /path/to/joomla/logs>
Order deny,allow
Deny from all
</Directory>

Replace /path/to/joomla/ with your actual server path. If you don't have access to httpd.conf/vhost config on shared hosting, place an equivalent <Files>/<FilesMatch> rule inside a .htaccess file within that folder instead — <Directory> blocks are ignored inside .htaccess on most Apache setups.

Step 5: Move the Logs and Temp Folders

By default, Joomla stores logs and temporary files inside web-accessible directories. Moving them outside the web root means they can't be requested over HTTP even if permissions are misconfigured.

1. Create new folders outside public_html (ask your host for the correct path if you're not sure).
2. In Joomla, go to System → Global Configuration → Server and update the Path to Log Folder and Path to Temp Folder fields to point to the new locations.

🖼️ [IMAGE NEEDED — STEP 5] Screenshot of Joomla admin: System → Global Configuration → Server tab, with the "Path to Log Folder" and "Path to Temp Folder" fields circled in red.

Step 6: Secure the .htaccess File Itself

Your .htaccess is the gatekeeper for most of the rules above — make sure it can't be read or modified over HTTP:

<Files .htaccess>
Order allow,deny
Deny from all
</Files>

Step 7: Block PHP Execution in Upload Folders

A large share of Joomla hacks happen through file upload fields that end up storing a malicious PHP file inside /images or /media. Stop any PHP script in those folders from ever executing by placing a dedicated .htaccess inside each one with this rule:

<FilesMatch "\.php$">
Order deny,allow
Deny from all
</FilesMatch>

Step 8: Regularly Scan File Integrity

Permissions and .htaccess rules reduce the attack surface, but you still need to know if a file changes. A Joomla security extension that checks file hashes against Joomla core and flags new/modified files closes that gap. [CẦN BẠN XÁC NHẬN: xác nhận lại tên và version security extension bạn thực sự khuyến nghị/đã test — bản gốc nhắc đến SecurityCheck Pro, RSFirewall, Admin Tools Pro, cần bạn xác nhận các tool này còn tương thích Joomla 6.x hay không trước khi publish.]

Step 9: Remove Unused Files and Installations

Old template folders, leftover backup archives (.zip, .sql), and abandoned installations left in a subfolder (e.g. /joomla_old) are common entry points because they're often outdated and unpatched. Delete anything you're not actively using.

Step 10: Use Secure File Transfer Methods

Always use SFTP or SSH instead of plain FTP. Plain FTP sends your credentials — and every file you transfer — unencrypted, which makes them easy to intercept on shared or public networks.

❓ Frequently Asked Questions

What file permissions should Joomla use?

Use 755 for directories and 644 for files. Never set 777 — it gives read, write, and execute access to everyone, including anyone who manages to reach your server.

Why is configuration.php a security risk?

It stores your database name, username, password, and site paths in plain text. If it's readable over HTTP, an attacker gets direct access to your database credentials.

Does moving the logs folder actually improve security?

Yes — files outside the web root can't be requested by URL at all, even if a permission or .htaccess rule is later misconfigured. It's a defense-in-depth step, not a replacement for correct permissions.

Is FTP safe to use for Joomla file management?

No. Plain FTP transmits your login credentials and files unencrypted. Use SFTP or SSH, which encrypt the entire connection, instead.

Do I need a security extension if my permissions are already correct?

Yes. Correct permissions block common attack paths, but a file-integrity scanner is what tells you if a file was modified anyway — through a vulnerable extension, a compromised admin account, or a server-level issue.

🧯 Common Mistakes to Avoid

• Using 777 "just to fix a permissions error" — this is almost always a temporary fix that gets forgotten and left wide open.
• Putting the upload-folder PHP block in the wrong .htaccess — it only works when placed inside /images or /media themselves, not the site root.
• Blocking /administrator entirely with a Deny from all rule — this locks you out too; use an IP allowlist or a security extension's admin protection instead.
• Forgetting the web server user still needs write access to specific folders like /cache, /tmp, and /images — a blanket 644/755 pass can break uploads or caching if applied without exceptions.
• Never testing after changing .htaccess rules — always reload the front end and back end before walking away; a syntax error in .htaccess can produce a full site 500 error.

➡️ What's Next

• Enable HTTPS and SSL in Joomla
• Joomla Security Checklist
• Joomla 6 – Newbie Guide