Support

Prevent fingerprinting. Malicious users tend to scan the publicly available, static files a site before attacking it to find out if it has an old, vulnerable version of Joomla or one of its extensions installed. This is called "fingerprinting". Part of the fingerprinting is accessing translation INI files and static CSS, JS and image files in the administrator folder. Applying password protection will make fingerprinting less reliable for the attackers which makes it less likely they will attempt to attack your site at all.

On the flip side, if you have software which incorrectly stores static files (CSS, JS, images, ...) in the administrator folder and expects them to be accessible on the front-end of the site this will "break" your site, in the sense that some or all of your frontend pages will be asking your site visitors for a username and a password. If this happens you can choose the "All PHP Files" or "Joomla" options under Administrator resources to protect. In this case, though, your site will not be protected against fingerprinting. It's best to ask the developer of the offending extension to move the common static files into Joomla's media folder which has been available since 2007. Then you can upgrade your Administrator resources to protect option to Everything to get the best protection on your site.

Direct access to vulnerable files. Your extensions' backend files, including .php files, are stored in the administrator folder. While it's customary for .php files to have a protection against direct web access it's possible that someone forgot about that or deliberately expects these files to be web accessible for site administrators. A malicious user can directly access these files. If these files have a security vulnerability it's possible for the malicious user to perform unintended operations ("hack") your site. Using a password protection on the administrator directory with the Administrator resources to protect option set to Everything all All PHP Files will mitigate this problem.

On the flip side, some third party extensions place .php files in the administrator folder and expect them to be publicly accessible. The most common use case is e-commerce extensions putting payment callback scripts in the administrator directory. In this case you'd need to set the Administrator resources to protect option to Joomla. However, in this case your site would not be protected against neither fingerprinting nor direct access to vulnerable files. The correct approach is to use a custom component controller; or com_ajax together with a plugin, module or template. The former option is available since Joomla 1.0 released in 2005. The latter option is available since 2013. Even in cases where a remote service cannot use a URL with query string parameters (therefore requires a directly accessible .php file) it's perfectly possible to either create a redirect in the .htaccess, NginX configuration or web.config file; or create a directly accessible .php file which operates as a "shim" for calling com_ajax. Please ask the developer of the offending extension to use one of these solutions. Then you can upgrade your Administrator resources to protect option to Everything to get the best protection on your site.

Brute force Joomla administrator login. A lot of malicious users employ automated software ("bots") to try several different combinations of common usernames and passwords against your administrator login page. On most sites this would succeed, allowing the attacker to log into your site and wreak havoc. Using the administrator password protection is one of the protection layers you can apply to your site to mitigate this kind of attacks. The attacker would first need to figure out this common username and password before attempting to brute force your Joomla login. Moreover, the password protection is super fast; practically speaking, this allows your server to reject the requests from the attacker's bots without consuming too many resources and without running the risk of slowing down your site or rendering it inaccessible. You should also at the very least use long, complex password (ideally: randomly generated passwords with at least 32 lowercase and uppercase letters, numbers and symbols) stored in a password manager; a password you can easily remember is NOT a secure password! Moreover, you should also be using Two Factor Authentication (built into Joomla) or Two Step Verification (available free of charge with Akeeba LoginGuard). If you have Joomla 4, you should also look into enabling Web Authentication if your device permits it for easier and more secure logins. Finally, you should DISABLE Joomla's "shared sessions" feature since it allows someone to log into the frontend of the site and immediately gain access to the backend of the site as well. This is a security nightmare, mitigated by the administrator password protection.

Everything. All files and folders (including those in subdirectories) of the administrator folder of your site will be password-protected. Please note that this is the only option which password-protects access to static resources such as CSS, JS and image files.

All PHP files. Only the access to .php files will be password protected as long as these files are placed in the administrator folder of your site or inside any of its subdirectories, no matter how many folders deep. This options DOES NOT protect static resources such as CSS, JS and images files with a password.

Joomla. Only access to Joomla's administrator application will be protected with a password. This is the weakest form of protection. We do not recommend this unless you have a specific reason to do so and you're also using the .htaccess Maker's Backend Protection feature (only available in the for-a-fee Professional edition of our software).