Disables direct access to most back-end resources, except those in the exceptions lists. It is generally recommended to turn it on to enhance the protection of your site.

This is a list of back-end directories (that is, subdirectories of your site's administrator directory) where you expect media files to be present. Place one directory on each line. Subdirectories of those directories are automatically added to the exceptions list without having to explicitly list them here. You can add more lines using the + buttons. You can remove a line using the - button. You can rearrange the order of the lines by clicking and dragging the button that looks like four arrows pointing North, South, East and West. You must not type the administrator/ prefix. As you can see, it's already added for you and can't be removed. You do not need to type a trailing forward slash. Please note that the path separator is the forward slash (/), even on Windows.

The default list is:

The extensions of back-end files which allowed to pass through the server protection filter, as long as the files with those extensions are in the list above. Do not type the leading dot for each file extension. Add file extensions by clicking at the end of the list, typing the extension and pressing ENTER. Delete file extensions by pressing the X next to them. Extensions are case–insensitive as of 7.0.6; this means that entering pdf will also match the extensions PDF and Pdf. The convention is to type in the extensions in lowercase. Regardless of the case–insensitivity of Admin Tools, it is a good idea to have the extensions of the files you upload in lowercase to avoid issues with third party extensions, Joomla itself and software running on case–sensitive–aware Operating Systems such as Linux.

The default list is: jpe, jpg, jpeg, jp2, jpe2, png, gif, bmp, css, js, swf, html, mpg, mp3, mpeg, mp4, avi, wav, ogg, ogv, xls, xlsx, doc, docx, ppt, pptx, zip, rar, pdf, xps, txt, 7z, svg, odt, ods, odp, flv, mov, htm, ttf, woff, woff2, eot, webp, ico, xsl, json, bpe

Certain static media types, such as HTML and SVG, may contain client-side scripts in JavaScript. It would be possible for an attacker to use a legitimate site feature or a vulnerability on your site to upload such an HTML or SVG file to one of the “Back-end directories where file type exceptions are allowed” folders or otherwise trick a Super User to do that. Then, they could exploit a well-meaning, legitimate feature of your site or otherwise trick a Super User into opening that file on their browser while they are logged into your site as a Super User. The client-side script could therefore “steal” the Super User's cookie, send it to the attacker who can now impersonate the Super User on the site.

When you enable this option, the allowed static media types in these directories will have a Content-Security-Policy header forcibly applied to them which tells the browser to not let them load any external script or execute any inline script or scriptable attribute, thereby neutering client-side script execution.

If you have a few select files which need client-side scripting, e.g. forms, animation demos etc, we recommend that you allow them explicitly in the Exceptions section described further below this documentation. If you can't enumerate all of these files you can disable this option but bear in mind that this reduces the security of your site.

Disables direct access to most front-end resources, except those in the exceptions lists. It is generally recommended to turn it on to enhance the protection of your site.

Enabling this feature will prevent web access to all folders in your site's root, not just Joomla's folders (such as components). If you need to enable direct access to a folder you will need to place it in one of the front-end directory exception lists in the Fine-tuning or Exceptions section.

This is a list of front-end directories (that is, directories in your site's root) where you expect media files to be present. Place one directory on each line. Subdirectories of those directories are automatically added to the exceptions list without having to explicitly list them here. You can add more lines using the + buttons. You can remove a line using the - button. You can rearrange the order of the lines by clicking and dragging the button that looks like four arrows pointing North, South, East and West. You must not type the administrator/ prefix. As you can see, it's already added for you and can't be removed. You do not need to type a trailing forward slash. Please note that the path separator is the forward slash (/), even on Windows.

Use this to allow access to specific types static media files inside specific directories. This is the least permissive exception to front-end blocking. Use this for folders which have a mix of public and private content, as long as the private content is NOT of an allowed file type (see below).

The default list is:

The extensions of front-end files which allowed to pass through the server protection filter, as long as the files with those extensions are in the list above. The same controls and rules as “Back-end file types allowed in selected directories” apply.

The default list is: jpe, jpg, jpeg, jp2, jpe2, png, gif, bmp, css, js, swf, html, mpg, mp3, mpeg, mp4, avi, wav, ogg, ogv, xls, xlsx, doc, docx, ppt, pptx, zip, rar, pdf, xps, txt, 7z, svg, odt, ods, odp, flv, mov, htm, ttf, woff, woff2, eot, webp, ico, xsl, json, bpe

Certain static media types, such as HTML and SVG, may contain client-side scripts in JavaScript. It would be possible for an attacker to use a legitimate site feature or a vulnerability on your site to upload such an HTML or SVG file to one of the “Front-end directories where file type exceptions are allowed” folders or otherwise trick a Super User to do that. Then, they could exploit a well-meaning, legitimate feature of your site or otherwise trick a Super User into opening that file on their browser while they are logged into your site as a Super User. The client-side script could therefore “steal” the Super User's cookie, send it to the attacker who can now impersonate the Super User on the site.

When you enable this option, the allowed static media types in these directories will have a Content-Security-Policy header forcibly applied to them which tells the browser to not let them load any external script or execute any inline script or scriptable attribute, thereby neutering client-side script execution.

If you have a few select files which need client-side scripting, e.g. forms, animation demos etc, we recommend that you allow them explicitly in the Exceptions section described further below this documentation. If you can't enumerate all of these files you can disable this option but bear in mind that this reduces the security of your site.

Place one file per line which should be exempt from filtering, therefore accessible directly from the web. The default settings include Akeeba Backup Professional and, of course, Admin Tools itself.

Please remember that you are entering the file path relative to your site's root, not a URL. If you want to allow the URL http://www.example.com/mysite/components/com_example/foobar.php?test=1&whatever=2 and your site is hosted at http://www.example.com/mysite you need to enter components/com_example/foobar.php here. Here's how we figured this out. Start by removing the question mark from the URL and everything that's to its right. Then, remove the site's root URL from the left part of the remaining URL. Finally, remove the leading forward slash — as you can see, it's already included for you and you can't remove it.

You can add more lines using the + buttons. You can remove a line using the - button. You can rearrange the order of the lines by clicking and dragging the button that looks like four arrows pointing North, South, East and West. Please note that the path separator is the forward slash (/), even on Windows.

Note

Files added to this list can be directly accessed regardless of whether their extension is in the "Backend file types allowed in selected directories" or "Frontend file types allowed in selected directories". These files will NOT be subjected to the restrictions imposed by "Disable client-side risky behavior in backend static content" and "Disable client-side risky behavior in frontend static content". Files which are made inaccessible because of their ownership, permissions, directory password protection, directives in the "Custom .htaccess rules at the top of the file" or "Custom .htaccess rules at the bottom of the file", directives in the .htaccess of a parent folder, directives in the server's main configuration files, or generally any reason outside the control of Admin Tools and its developers ARE NOT guaranteed to be made accessible. These outside reasons require manual intervention to overcome which may or may not be possible through a .htaccess file.

Default list:

The first and third items on the list are deprecated. They are there for Akeeba Backup 8 and Joomla versions prior to 4.0.3.

Direct access to all files (except for .php files) will be granted if they are inside any of the directories in this list AND their subdirectories. Normally you should only need to add your forum's attachments, avatars and image galleries directories, or other directories where you only intend to store media files. As with all similar options, add one directory per line, without a leading or trailing slash.

This is a middle ground in front-end blocking. You should use this only for folders which have only public content, i.e. if it's in that folder you are OK with it being shared with the rest of the world.

You can add more lines using the + buttons. You can remove a line using the - button. You can rearrange the order of the lines by clicking and dragging the button that looks like four arrows pointing North, South, East and West. You do not need to type a trailing forward slash. Please note that the path separator is the forward slash (/), even on Windows.

Note

Files in directories added to this list can be directly accessed regardless of whether their extension is in the "Backend file types allowed in selected directories" or "Frontend file types allowed in selected directories", as long as the file name does not end with the string literal .php (case-sensitive). These files will NOT be subjected to the restrictions imposed by "Disable client-side risky behavior in backend static content" and "Disable client-side risky behavior in frontend static content". Files which are made inaccessible because of their ownership, permissions, directory password protection, directives in the "Custom .htaccess rules at the top of the file" or "Custom .htaccess rules at the bottom of the file", directives in the .htaccess of a parent folder, directives in the server's main configuration files, or generally any reason outside the control of Admin Tools and its developers ARE NOT guaranteed to be made accessible. These outside reasons require manual intervention to overcome which may or may not be possible through a .htaccess file.

Default list:

This option should be used sparingly as possible. Each and every directory placed in this list is no longer protected by Server Protection AT ALL and can be potentially used as an entry point to hacking your site. To be clear, if an attacker uploads a malicious file in one of these directories by exploiting a vulnerability which allows them to upload predictably named files in predictably named folders they will be able to access it over the web. This is how sites get hacked. As far as we know there are only three cases when its use is even marginally justifiable:

It's best to use the Allow direct access to these files feature if possible, allowing access only to very specific .php files.

Remember that an attacker who has found an upload vulnerability on your site can upload a malicious script inside one of these folders and use it to hack you. These folders are totally unprotected. That's why we very strongly advise against using this feature unless it's absolutely necessary - keeping in mind that you are, at the same time, leaving a hole in your security defences.

You can add more lines using the + buttons. You can remove a line using the - button. You can rearrange the order of the lines by clicking and dragging the button that looks like four arrows pointing North, South, East and West. You do not need to type a leading or trailing forward slash. Please note that the path separator is the forward slash (/), even on Windows.

Note

Files in directories added to this list can be directly accessed regardless of whether their extension is in the "Backend file types allowed in selected directories" or "Frontend file types allowed in selected directories". These files will NOT be subjected to the restrictions imposed by "Disable client-side risky behavior in backend static content" and "Disable client-side risky behavior in frontend static content". Files which are made inaccessible because of their ownership, permissions, directory password protection, directives in the "Custom .htaccess rules at the top of the file" or "Custom .htaccess rules at the bottom of the file", directives in the .htaccess of a parent folder, directives in the server's main configuration files, or generally any reason outside the control of Admin Tools and its developers ARE NOT guaranteed to be made accessible. These outside reasons require manual intervention to overcome which may or may not be possible through a .htaccess file.