Brute-force attacks on Joomla sites are common these days. The reality website owners must face is that hackers are in control of large farms of hacked computers. These computers can be used to coordinate massive brute-force attacks on a website.

As a website owner, in fact I'm hosting several sites, I'm constantly getting these types of attacks on my servers. In this post, I look at a few ways to reduce the chance that someone gains unlawful access to your Joomla websites by way of brute-force attacks.

So, what is a brute-force attack?

Let’s see what Wikipedia says:

In cryptography, a brute-force attack, or exhaustive key search, is a cryptanalytic attack that can, in theory, be used against any encrypted data (except for data encrypted in an information-theoretically secure manner). Such an attack might be used when it is not possible to take advantage of other weaknesses in an encryption system (if any exist) that would make the task easier. It consists of systematically checking all possible keys or passwords until the correct one is found. In the worst case, this would involve traversing the entire search space. When password guessing, this method is very fast when used to check all short passwords, but for longer passwords other methods such as the dictionary attack are used because of the time a brute-force search takes.

In short, a brute-force attack is trying to force itself into your website administrator by trying every combination of username and password it can come up with.

There are two main problems with this for you as a website owner. Obviously, it’s not good having people snoop around in your Joomla admin with super administrator rights. That’s a given. The other thing to be concerned a about is the fact that such attacks take away a lot of capacity from your server.
How to protect yourself from brute-force attacks

There are several things you can do to make things harder for those trying brute-force attacks. Longer and more complex usernames passwords is one, blocking access to the site is another.

Strong usernames and passwords

You’ve heard it time and time again: Make sure you have strong passwords! Usernames are important, too.

I have made it a habit to never use ’admin’ or ’administrator’ or anything like it as usernames on my websites. I choose a unique username for each site.

When it comes to passwords, I always use 20 random alphanumeric characters or more, in a combination of lower and upper case, and with some symbols thrown in. And I never use a password for more than one website.

20 characters, you say? How on earth do you remember that?

Three words: Password Management Software.
Manage your passwords with ease

Personally, I use LastPass.com to both generate and manage my passwords. I’ve heard lots of good things about 1Password as well, so if you’re on a Mac you might wanna try that out.

Using these tools, there is no problem managing hundreds, or thousands of passwords with ease. Just make sure you have a solid master password, and you might consider investing in a Yubikey for a two-factor authentication with Joomla.
Blocking access to the site

Another method of avoiding the perils of brute-force attacks is to restrict access to the website or server based on the attackers IP or IP range. There are several ways to do this:

    Using a Joomla extension
    Using .htaccess blocking
    Blocking the IPs in your firewall

Joomla extension

I recommend AdminExcile as an excellent plugin for Joomla 2.5 or later. It lets you block IPs after a certain amount of failed password attempts, and you can set how long the block will be in effect for. This has proven very effective for me, as I’ve avoided some very nasty attacks.

I recently had an attack on a website where over 4000 machines tried to brute-force their way into a Joomla site. It didn’t succeed, and we managed to block the IPs permanently rather quickly. Another day, I had 25000 brute-force attempts on another website. That’s when I adjusted the AdminExcile plugin to block the perpetrators after fewer attempts and for a longer period of time. That definitely helped.

The main reason the attack didn’t succeed was strong passwords. AdminExcile, however, can prevent your site from going down by blocking the IPs after X failed attempts.
Using .htaccess blocking

On Apache servers, you can add IP addresses to your .htaccess file. This will prevent those IP addresses from even reaching your Joomla administrator page or any other page on your website.

Here’s a tool that makes it easy to create the snippets you need for your .htaccess file:

http://www.htaccesstools.com/block-ips/

Example code:

    Order Deny,Allow
    Deny from 199.442.33.32

Read more about using .htaccess to block visitors with various methods.
Blocking the IPs in your firewall

If you’re on a dedicated server or your own network, blocking IP ranges on the firewall might be a good option. Be advised, though, that this may block some valid traffic to your site. For some sites, this won’t be a problem. If I have a local site that has no clients from outside my country, I can block IP addresses from a whole country if I so wish. It won’t affect my business. If you’re business is international, you need to consider this more carefully and pinpoint specific IP addresses or limited ranges.
Conclusion

To conclude, brute-force attacks is probably something we need to live with. There are, however, quite a few things you can do to limit the chance of someone succeeding with such an attack. The first thing you should do is increase the complexity of your admin passwords.

Best Joomla Hosting Recommendation

ASPHostPortal.com provides our customers with Plesk Panel, one of the most popular and stable control panels for Windows hosting, as free. You could also see the latest .NET framework, a crazy amount of functionality as well as Large disk space, bandwidth, MSSQL databases and more. All those give people the convenience to build up a powerful site in Windows server. We offers Joomla hosting starts from $5/month only. We also guarantees 30 days money back and guarantee 99.9% uptime. If you need a reliable affordable Joomla Hosting, we should be your best choice.

Choosing a Moodle hosting company can be a tedious process because of the large numbers of number of hosting companies on the market, considerations to make and options to choose from. Going through all of them to check is a near impossible task. But ASPHostPortal.com is Moodle hosting provider that must be in your consideration. We offer Moodle 2.9.1 hosting with excellent service, faster and stable network.

Moodle is the open source platform that lets you build the perfect education solution for your needs. The Moodle learning platform is based on strong pedagogical principles, providing a private learning space for you to design online courses with flexible content and collaborative activities so your students are constantly experiencing feedback. Moodle platform has been used worldwide by millions of users from vast corporations in village classrooms with all shapes, sizes and flavours in between. They were empowered learning everywhere.

Moodle is a modular system based on plugins, which are like Lego blocks that you put together to build whatever you want. There are plugins for different kinds of content, and plugins for all kinds of collaborative activities, which is where Moodle really shines. As an example their Workshop plugin manages a full peer assessment process, so you can get hundreds of students accurately grading each other’s assignment (that can save you a lot of time!). Add some tracking and reports and the ability to add more plugins from the community or even ones you write yourself, and you can build some pretty amazing education environments.

ASPHostPortal.com provides Premium Moodle 2.9.1 Hosting on high performance servers and high-speed internet connection in the world. Every server is equipped with at least 2x Intel Xeon Quad-Core processors and massive amounts of memory. We are using SSD's for storage, which provides much higher performance in terms of I/O and data transfer speed. The servers are connected to the network using multiple 1Gbps ports (bond network). So your Moodle education environment won’t be down and always up at the high rate speed connection. To learn more about their Moodle 2.9.1 Hosting, please visit http://asphostportal.com/Moodle-2-9-1-Hosting

About ASPHostPortal.com :
ASPHostPortal.com is The Best, Cheap and Recommended ASP.NET & Linux Hosting. ASPHostPortal.com has ability to support the latest Microsoft, ASP.NET, and Linux technology, such as: such as: WebMatrix, WebDeploy, Visual Studio 2015, .NET 5/ASP.NET 4.5.2, ASP.NET MVC 6.0/5.2, Silverlight 6 and Visual Studio Lightswitch, Latest MySql version, Latest PHPMyAdmin, Support PHP 5.x, etc. Their service include shared hosting, reseller hosting, and sharepoint hosting, with speciality in ASP.NET, SQL Server, and Linux solutions. Protection, trustworthiness, and performance are on the core of hosting operations to make certain every website and software hosted is so secured and performs at the best possible level.

What's New in Joomla 3.4.4?

What's Joomla?

Joomla is a free and open-source content management system (CMS) for publishing web content. It is built on a model–view–controller web application framework that can be used independently of the CMS. Joomla is written in PHP, uses object-oriented programming (OOP) techniques and software design patterns, stores data in a MySQL, MS SQL, or PostgreSQL database, and includes features such as page caching, RSS feeds, printable versions of pages, news flashes, blogs, search, and support for language internationalization.

Jommal provides an online collaborative community manual for Joomla! users, developers or anyone interested in learning more about Joomla! Currently, they have over 4000 articles written and maintained by Joomla! community members.

New in Joomla 3.4.4

• Further en-GB language cleanup
  
• Fixes for MSSQL and PostgresSQL Joomla installations
  
• jQuery, HTML5Shiv and CodeMirror updates
  
• Finished implementing the Joomla codestyle rules

Joomla can be used for

• Specialist websites
  
• Simple websites
  
• Custom applications
  
• Many design options

The benefits of having a Joomla website:

• Website is easy to update
  
• Website can be updated from anywhere with an internet connection
  
• Multiple people can access the administration site at the same time
  
• Design changes are easy to implement
  
• There is no need to pay a specialist to do the updates
  
• You control when you want to do the updates

Best Joomla Hosting Recommendation

ASPHostPortal.com provides our customers with Plesk Panel, one of the most popular and stable control panels for Windows hosting, as free. You could also see the latest .NET framework, a crazy amount of functionality as well as Large disk space, bandwidth, MSSQL databases and more. All those give people the convenience to build up a powerful site in Windows server. We offers Joomla hosting starts from $5/month only. We also guarantees 30 days money back and guarantee 99.9% uptime. If you need a reliable affordable Joomla Hosting, we should be your best choice.

Although WordPress is free and usually you can use it as a separate individual without any problem, for any business website you need a web hosting and your own domain to make a business out of your blog or business website. Using open source WordPress with your own domain having a unique identity makes it profitable brand. Purchasing a domain name is easy, but you have to consider certain factors while choosing a hosting provider for WordPress websites. ASPHostPortal.com is reliable and powerful WordPress hosting provider for you. Today, they offer WordPress 4.3 hosting with excellent service and complete WordPress package.

WordPress is a publishing platform used for building websites and blogs. It allows for a highly customizable user interface. WordPress powers millions of websites in worldwide, and many big brands use WordPress: CNN, PlayStation, New York Times Blogs, People Magazine, and even Ford- they all use WordPress. Pretty impressive list of users, if it’s good enough for the big boys, it’s good enough for your site.

A great thing about WordPress is, it's completely open source which means that the source code used to run WordPress is available to the general public. This means that anyone on the planet can modify the code if necessary and customize WordPress even further to be what they need. Often, this isn't necessary, but it also means that some plugins and themes (templates) created for the platform are also open source. Imagine a world-wide community working together to add more features and functionality to WordPress, you're not limited to only being able to use specific employees or developers to produce customizations, which means it's a powerful CMS system ready to do what you need it to, it's flexible, and easy to customize.

ASPHostPortal.com is a web hosting provider dedicated to providing high quality web hosting at an affordable price. They care for the clients, ensuring each and every client is more than just satisfied day in and day out. They only use the best hardware, super fast network, covered by 24/7 Support Team. They have locations in 8 world class data centers, located USA, Europe, Asia and Australia. Each of locations will provide with amazing performance. To learn more about their WordPress 4.3 Hosting, please visit http://asphostportal.com/WordPress-4-3-Hosting

About ASPHostPortal.com :
ASPHostPortal.com is The Best, Cheap and Recommended ASP.NET & Linux Hosting. ASPHostPortal.com has ability to support the latest Microsoft, ASP.NET, and Linux technology, such as: such as: WebMatrix, WebDeploy, Visual Studio 2015, .NET 5/ASP.NET 4.5.2, ASP.NET MVC 6.0/5.2, Silverlight 6 and Visual Studio Lightswitch, Latest MySql version, Latest PHPMyAdmin, Support PHP 5.x, etc. Their service include shared hosting, reseller hosting, and sharepoint hosting, with speciality in ASP.NET, SQL Server, and Linux solutions. Protection, trustworthiness, and performance are on the core of hosting operations to make certain every website and software hosted is so secured and performs at the best possible level.

I'm hoping to make a website for myself, which I want this blog to be a part of. But how to do it. Well, at first I thought I'd just have it as a feed, but actually I want to incorporate it fully into the joomla site. So.... as for blogger posts, here is the way to do it:

Export from Blogger

Log into your blogger account, go into the Settings page of the blog that you want to export. Under Blog Tools, click Export Blog. Click on Download in the next page. Download the .xml file that Blogger packs for you. It is a collection of all your posts, comments, settings, widgets and template.

Upload .xml to Server

Upload the file you downloaded to your server.

Feed2Post configuration

After that, download Feed2Post for Joomla. It is a commercial component that costs $15. If you want to download it for free, source it on your own :).

Log into Joomla, install Feed2Post component. Go to Component>Feed2Post>View/Edit Entries

• Put in your feed title. The title will not appear in the posts you import.
• Point the URL to the address of the .xml file that you have uploaded to your server. It should be something like http://yourdomain.com/blog-xx-xx-xxxx.xml
• Fill in the Section and Category that you want the posts to appear in. If you intend to import into different categories, you need to repeat this procedure.
• For Post as User, you can assign the author of the blog posts to your current username. If you have multiple authors, you need to repeat this procedure.
• Make sure that Full Text Gather, Show Intro, Open Readmore Link at iframe and Include Original Date is set to No.
• Set feed date as created date to Yes and Store Author to Don’t Store.
• Save.

Importing Posts

• Go back to the View/Edit Entries page and check the feed that you have just created. Make sure that the feed is set to Published.
  
• Click on Items next to Post All at the top right corner.
  
• You may need to wait a bit for it to load. When the page loads, you will be able to view all comments and blog posts from your Blogger account.
  
• Check those items that you want to export as blog posts to the Category (and author) that you have defined earlier.
  
• Once that is done, click Post at the top right corner.
  
• This may take quite long to load if you select a lot of items.
  
• If the import is successful, you should see a notification. Your posts should now be in the Article Manager. Your job is done if you are importing all the posts into one category.
  

If you have Multiple Categories and Authors Set Up..

• Go back to View/Edit Entries page and check the feed. Click on the Change button at the top.
• Set the Section, Category and Post as User to the next setting.
• Repeat the steps in Importing Posts above.

If this helped you, I would appreciate a word of thanks or a tweet. :) I am still trying to import comments into Joomla. If anyone can help, it’ll be great!

Best Joomla Hosting Recommendation

ASPHostPortal.com provides our customers with Plesk Panel, one of the most popular and stable control panels for Windows hosting, as free. You could also see the latest .NET framework, a crazy amount of functionality as well as Large disk space, bandwidth, MSSQL databases and more. All those give people the convenience to build up a powerful site in Windows server. We offers Joomla hosting starts from $5/month only. We also guarantees 30 days money back and guarantee 99.9% uptime. If you need a reliable affordable Joomla Hosting, we should be your best choice.

How to insert a PDF file in a Joomla article with JCE File Manager

Joomla is an open source content management system that allows you to build web sites and powerful online applications. This award-winning web site software contains easy-to-use features and it is freely available to everyone. In this tutorial, I will show you how to accomplish the same using the File Manager plug-in for JCE.

Using the JCE File Manager makes the job a lot easier. The File Manager is a plug-in to the very popular Joomla Content Editor. The plug-in is part of the package you get when subscribing. JCE itself is free, but the File Manager, Media Manager, Image Manager Extended and some other plug-ins are paid.

This is how you insert a PDF file into a Joomla article with JCE:

Create a new article and a text. Select the text and click the "Insert / edit File" button

You will see the File Manager window.

Select the folder you want to upload your file to (or create it using the "New Folder" button).

Then, click the "Upload file" button.

You will see the upload window.

Click "Browse" and select the file from your harddisk. If you're using Firefox, you can drag and drop the file into the upload window. You can add as many files as you want to in this step.

If you try to upload a file that is bigger than 1024 Kb, you will get an error message like this:

To adjust the file size allowed, go to JCE Administration -> Profiles -> The profile you are using (normally "Default").

Then click the"Plugin Parameters" tab at the top and the "File Manager" tab on the left.

You can now see your server's max upload size and adjust the allowed size. In the below example I've set it to 5 Mb (5000 Kb).

Go back to your article and try to upload again.

You should now see the file(s) in the upload window after browsing for them (as long as they are below your set maximum upload size, that is).

Click "Upload"-

The file(s) will upload to the web server

When the file(s) are uploaded, close the upload window and you will see the file(s) in the File Manager.

You can now adjust the parameters available before you insert the PDF link into the article.

As you can see, you can add an icon (will be set automatically according to the file type), a size parameter or the date. You can also adjust the actual anchor text (the link text) from this window as well. When clicking the document file, you will notice that the File Manager asks you if you want to change the link text to the file name. Sometimes this is a good idea, other times I want to have a more descriptive text as the link. That's really up to you to decide.

Click "Insert" and you will return to the article with the link inserted.

In this case, I chose to add the size to the link. However, if I decide that I don't want it after all, I can remove it directly from the editor. It is actually a normal link, so it behaves exactly the same way as any other link. So, if I remove the size, I get the final PDF link like this:

Even though it seems like a lot og steps, once you get the hang of the technique it is really fast to do. And much more efficient than doing it with the Joomla core, which really is a kind of workaround.

This was a pretty interesting issue to find and resolve. It's an database 'error' of sorts that is pretty simple to fix. First of all this is all due to a parent<-child condition that has gone horribly wrong in an update or something else. Most likely you will find this issue in the table "assets". You will need to find your database prefix fist of all, easiest found in the configuration and the option "$dbprefix". I will call it "prefix_" here for ease of typing.

So to find if you have this issue you can run the following in an sql manager of your choosing (mysql or phpmyadmin shoulden't make any differents, i did it in the cli mysql)

SELECT id,parent_id,title FROM `prefix_assets` WHERE parent_id=0;

If you find that there are multiple rows then hit the above do the following

UPDATE `prefix_assets` SET parent_id=1 WHERE parent_id=0 AND NOT id=1;

You should also verify that the "Root Asset" has id 1 and parent_id 0

SELECT id,parent_id,title FROM `prefix_assets` WHERE id=0 OR parent_id=0;

this should give the result

id    parent_id    title
 1    0               Root Asset

if not run

UPDATE `prefix_assets` SET parent_id=0 WHERE title="Root Asset";

This should have fixed the issue.

Best Joomla Hosting Recommendation

ASPHostPortal.com provides our customers with Plesk Panel, one of the most popular and stable control panels for Windows hosting, as free. You could also see the latest .NET framework, a crazy amount of functionality as well as Large disk space, bandwidth, MSSQL databases and more. All those give people the convenience to build up a powerful site in Windows server. We offers Joomla hosting starts from $5/month only. We also guarantees 30 days money back and guarantee 99.9% uptime. If you need a reliable affordable Joomla Hosting, we should be your best choice.

You just upgraded your Joomla site to latest Joomla 2.5 or 3.* and your regular, registered users cannot login to the frontend, seeing this error:

"You cannot access the private section of this site"

The causes are multiple, and there are many fixes out on the net. But the most common cause of this is the damaged "#_assets" table.

You can read more about how to fix it here.

But if you are in a hurry, and want a quick and dirty solution, try this:

• Open your database with your favorite tool (phpMyAdmin is ready to use in most hosting accounts)
• Locate the #_assets table (# is the replacement of your prefix)
• Check if the Root asset has the "parent_id" is set to 0, "level" is set to 0 and the "lft" set to 1 (or 0). also check to not have any other entries set to "level=0"
• If you are these fields set to any other values, try to reset them to 0 and 1 respectively.
• If that does not fix it, try to set the "lft"value to 0 - is highly non-standard, but fixes in most cases the issues.

If that does not fixes it, you have still all the time on the Earth to read that great Joomla article! (Highly recommended).

Ah, almost forgot. Do a backup first. And be sure, that the backup works. And don't forget, that this is qualifying as a core hack. Don't do it withouth the safety belt on!

Best Joomla Hosting Recommendation

ASPHostPortal.com provides our customers with Plesk Panel, one of the most popular and stable control panels for Windows hosting, as free. You could also see the latest .NET framework, a crazy amount of functionality as well as Large disk space, bandwidth, MSSQL databases and more. All those give people the convenience to build up a powerful site in Windows server. We offers Joomla hosting starts from $5/month only. We also guarantees 30 days money back and guarantee 99.9% uptime. If you need a reliable affordable Joomla Hosting, we should be your best choice.

If you’re a Joomla user who has connected his sites to Google Webmaster, you might have received the following message from the Google Search Console: “Google can’t access CSS and JS files”.

A while ago, Google announced that whether a website is mobile friendly or not is a factor in ranking websites. This message seems to be a result – Google is actively scanning websites using Webmaster and testing if they’re mobile friendly.

Since you’re blocking files Google wants to access, it could make the big G think that your site is, in fact, not mobile friendly. To avoid this, you need to tweak your robots.txt file. This is a file in your root folder which determins which robots – like Google’s bots that scan your site – can and can’t visit which folders.

To resolve this problem, you need to remove two lines from the robots.txt file; the line which disallows /media/ and /templates/. Doing this will grant Google access to the files it needs to analyze your website.

Best Joomla Hosting Recommendation

ASPHostPortal.com provides our customers with Plesk Panel, one of the most popular and stable control panels for Windows hosting, as free. You could also see the latest .NET framework, a crazy amount of functionality as well as Large disk space, bandwidth, MSSQL databases and more. All those give people the convenience to build up a powerful site in Windows server. We offers Joomla hosting starts from $5/month only. We also guarantees 30 days money back and guarantee 99.9% uptime. If you need a reliable affordable Joomla Hosting, we should be your best choice.

Yesterday I got an email from a very nice customer :) He said that whenever he tried to access the Template Manager he gets the following error:

"Cannot use a stream transport when "allow_url_fopen" is disabled."

Basically, the solution is very simple - enable "allow_url_fopen" in your PHP Configuration (php.ini for example or through your .htaccess file). So that's what I told him - "Contact your Hosting Support and ask them to enable "allow_url_fopen".

So far so good! But after few hours I got a reply from him saying that his Host has rejected his request with the following message:

"Unfortunately allow_url_fopen is extremely insecure so it cannot be enabled on shared servers.
Make sure the template is coded for Joomla 3.x version and also you can ask the template team to use cURL function instead of allow_url_fopen."

Honestly, I was almost shocked by this reply! Yes, I know there are quite some Hosting Providers that disable "allow_url_fopen" on their shared servers but this is either because they do not have enough knowledge or because they want to make you upgrade your Hosting Plan and that's how to charge you more money :)

So this is the main purpose of this article - to shut your Hosting Provider mouth or at least to educate them why "allow_url_fopen" MUST be enabled.

Enabling "allow_url_fopen" is a core Joomla requirement and it is written on their website. In order to have a properly working Joomla Website you must enable it. Just have a look at the following links and screenshots... they should be enough even for a small kid to understand that "allow_url_fopen" must be enabled and that this is not a Template/Framework related requirement, it is a Joomla core requirement!

There is nothing insecure with "allow_url_fopen". The security issue comes from "allow_url_include" and your Hosting Provider should know this very well.

So, if your Hosting Provider does not want to enable "allow_url_fopen" for you, the only smart thing you can do is to change them. Yes, simply find a normal, good Host!

Guys, feel free to forward this article to your Hosting Provider if needed. I'm very curious what their reply will be ;)

Best Joomla Hosting Recommendation

ASPHostPortal.com provides our customers with Plesk Panel, one of the most popular and stable control panels for Windows hosting, as free. You could also see the latest .NET framework, a crazy amount of functionality as well as Large disk space, bandwidth, MSSQL databases and more. All those give people the convenience to build up a powerful site in Windows server. We offers Joomla hosting starts from $5/month only. We also guarantees 30 days money back and guarantee 99.9% uptime. If you need a reliable affordable Joomla Hosting, we should be your best choice.