Securing Your Joomla Site with miniOrange JoomShield

Overview

Joomla sites are a common target for brute force attacks, fake registrations, and bots that probe the default admin login page. miniOrange JoomShield is a security plugin that closes these gaps by giving you a single dashboard to manage admin security, login and registration security, IP and browser blocking, site maintenance tools, and login activity reports. With JoomShield, you can hide your default admin login URL behind a custom path and access key, add a browser username and password prompt in front of the administrator area, protect sensitive JoomShield settings with a separate Feature Access Password, and create temporary administrator accounts that expire automatically. You can also enforce strong passwords, block registrations from unwanted email domains, look up suspicious IP addresses, restrict access by browser, take the public site offline instantly during an incident, clear temporary files, sign out active sessions, correct outdated site URLs, repair and optimize your database, and review a full log of login attempts. Sites running on Nginx get ready-made server rules that match your JoomShield settings. Premium features extend this further with brute force protection, manual IP blocking and whitelisting, IP range and country blocking, and email notifications for blocked IPs or unusual account activity.

JoomShield is compatible with Joomla 3, 4, 5, and 6. Here we will go through a step-by-step guide to configure JoomShield and secure your Joomla site's login, registration, and admin access.

Installation Steps

• Login into your Joomla site’s Administrator console.
• From left toggle menu, click on System, then under Install section click on Extensions.
• Now click on Or Browse for file button to locate and install the plugin file downloaded from the Joomla Extensions Directory.
• Installation of plugin is successful. Now click on Start Using miniOrange JoomShield Plugin

Configuration Steps

Once JoomShield is installed on your Joomla site, navigate to Components > miniOrange - JoomShield in your Joomla admin panel to access all the security settings described below. The Setup Guide, Import/Export, and Support buttons are available at the top of every tab.

Step 1: Configure Admin Security

• Navigate to the Admin Security tab from the JoomShield settings menu.
• Under Customize Admin Login Page URL, enable Enable Custom Login Page URL and enter an Access Key for your Admin login URL to replace the default /administrator path with a custom URL. The Current Admin Login URL field shows the URL you will use to log in. Choose where users are sent if access is denied using Redirect after Failure Response, then click Save. This feature is applied in PHP on both Apache and Nginx, so no extra .htaccess or Nginx server rules are required.
• Under Administrator Access Protection, enable Enable Administrator Access Protection to add a browser username and password prompt in front of the Joomla administrator URL. Enter a Protection username and Protection password. These credentials are separate from your Joomla user accounts.
• Add any trusted addresses to Whitelist IP addresses (comma separated). Use the visitor IP shown in the field's placeholder and in the login reports, and do not whitelist a private proxy address such as 172.31.x.x, since that address applies to every site opened from the same network.
• On Apache or LiteSpeed servers, you can optionally enable the checkbox to also write these restriction rules to the site's .htaccess file automatically. Nginx ignores .htaccess, so Nginx sites should use the rules from the Nginx Rules tab instead. PHP protection stays active even if the file cannot be written. Click Save. Expand How restriction rules are applied for details on how this works on your server.
• Combine Administrator Access Protection with Customize Admin Login Page URL for two layers of protection on your admin area.
• Under Feature Access Password, enable Enable Feature Access Password to set a separate password that must be entered before anyone can change a protected JoomShield feature. For first-time setup, leave Current Feature Access Password blank, then enter and confirm a new password in New Feature Access Password and Confirm Password.
• Under Select the features that require this password, choose which features to protect: Customize Admin Login Page URL, Login strong-password policy, Administrator Access Protection, Create Temporary User, Registration email-domain policy, Registration strong-password policy, Browser Blocking, IP Lookup, Clear Reports, Import Configuration, Emergency Site Offline, Clear Temporary Files, Purge Active Sessions, Repair and Optimize Database, and Correct outdated site URLs. Click Save.
• Under Create Temporary User, enter a Temporary username, Email, and Password, select the Access duration (hours), and click Create Temporary User. This creates a temporary Joomla administrator that expires automatically. The temporary user cannot open JoomShield, cannot create, update, or delete other users, and cannot install or remove extensions.
• In the free version, the temporary user is created as a Super User only. Creating a temporary user with any available Joomla user group requires the Premium version.
• All temporary users are listed in the table below the form, showing the temporary username, email, expiry time, who created the user, status, and available actions.

Step 2: Configure Login Security

• Navigate to the Login Security tab.
• Under Enforce Strong Passwords, enable Enable strong passwords to check the password strength of admin and other users at login. Click You can restrict the following conditions to user for strong password to view the password conditions, then click Save.
• Brute Force Protection is a Premium Feature that protects your site from attackers trying to log in with random usernames and passwords. It lets you set the Allowed login attempts before blocking an IP and the Time period for which IP should be blocked, choose whether to Show remaining login attempts to user, and enable Bypass for Admin console login.

Step 3: Configure Registration Security

• Navigate to the Registration Security tab.
• Under Block Registrations from fake users, enable Enable blocking of registrations from specific email domains and enter the email domains you want to block in Enter email domains you want to block, separated by semicolons (for example, nuevomail.com;finxmail.com).
• Click Save to apply the domain blocking rules.
• Under Enforce Strong Passwords, enable Enable strong passwords to require strong passwords for user registrations, then click Save.

Step 4: Configure IP Blocking

• Navigate to the IP Blocking tab.
• Under IP Lookup, enter an IP address in IPv4 or IPv6 format and click Lookup IP to trace what part of the country or world a suspicious visitor is accessing your site from. Click Clear to reset the field.
• Manual Block IPs is a Premium Feature that lets you block specific IP addresses and view them in a searchable table with the reason, blocked until time, blocked date, and actions.
• Whitelist IPs is a Premium Feature that lets you allow trusted IP addresses and view them in a searchable table with the whitelist date and actions.

Step 5: View Login Transaction Reports

• Navigate to the Reports tab to view the Login Transactions Report.
• This report logs login attempts on your site, including the Sr ID, username, site URL, IP address, status, failure reason, and the date and time in UTC. Click the Date & Time (in UTC) column header to sort entries by time.
• Use the dropdown to choose how many entries are shown per page, and the Search field to look up specific entries. Use Refresh Page, Clear Reports, and Download Reports to manage the report data, and Next to move between pages.

Step 6: Configure Advanced Blocking

• Navigate to the Advanced Blocking tab.
• Under Browser Blocking, enable Enable Browser blocking and select the browsers you want to block. In the free version, only Microsoft Edge is available for testing; blocking other browsers such as Chrome, Firefox, Safari, and Opera requires the premium version.
• Click Save to apply the browser blocking rules.
• IP Address Range Blocking is a Premium Feature that lets you block a range of IP addresses (for example, 192.168.0.100 - 192.168.0.190) and view all blocked ranges in a table.
• Country Blocking is a Premium Feature that lets you select countries to block visitors from.

Step 7: Configure Advanced Features

• Navigate to the Advanced Features tab.
• Under Emergency Site Offline, enable Enable Emergency Site Offline to take the public site offline immediately during an incident. Administrator access and whitelisted IPs remain available, so add any addresses that should keep access to Whitelist IP addresses (comma separated). This is an emergency overlay and does not replace Joomla's Global Configuration Site Offline setting for planned maintenance.
• Emergency Site Offline is applied in PHP on Apache and Nginx as soon as you click Save. On Apache or LiteSpeed, you can optionally enable the checkbox to also write the restriction rules to .htaccess, so Apache returns a 503 response to public visitors. On Nginx, copy the rules from the Nginx Rules tab (use the Open Nginx Rules button) only if you also want Nginx to block traffic before PHP. Expand How restriction rules are applied for details on your detected web server.
• After you disable Emergency Site Offline, the .htaccess rules are removed automatically when the Apache write option is enabled. On Nginx, replace any previously pasted JoomShield lines with the new snippet from the Nginx Rules tab, otherwise the site can stay blocked at the server.
• Under Clear Temporary Files, click Clear Temporary Files to remove files and folders from the site's temporary directory and free up disk space. The index.html, .htaccess, and web.config files are kept. This action cannot be undone.
• Under Purge Active Sessions, click Purge Active Sessions to sign out all users except your current administrator session. Users will need to log in again. Sessions stored in Redis or Memcached may not be fully cleared.
• Under Correct outdated site URLs, enable Correct outdated URLs on public pages and enter your Previous site addresses, one per line, such as an old domain or staging copy. Use the host only, or the host plus folder if the previous site used a subdirectory, without http, https, or a trailing slash. The This site's public address field shows your current site address. Click Save. JoomShield rewrites matching URLs in the HTML sent to visitors, while articles, menus, and other stored content are not changed. No extra .htaccess or Nginx server rules are required.
• Under Repair and Optimize Database, click Repair and Optimize Database to run a MySQL repair on applicable tables and optimize all site tables in batches. Take a database backup before running this. InnoDB tables skip the repair step, and optimizing may rebuild and briefly lock tables.

Step 8: Apply Nginx Rules

• Navigate to the Nginx Rules tab. This tab is only needed if your site is served by Nginx. Apache and LiteSpeed sites do not need it, as their extra restriction rules are written to .htaccess automatically when that option is enabled. The tab shows the web server detected for your site.
• Under Current restriction settings used to build these Nginx rules, check the current status of Emergency Site Offline, Administrator Access Protection, and Write Apache .htaccess rules.
• Under Nginx configuration snippet, click Copy snippet or Download Nginx snippet. The snippet already matches your current Emergency Site Offline and Administrator Access Protection settings.
• Paste the snippet into the server { } block of your site's Nginx configuration (often /etc/nginx/sites-available/your-site, or the Nginx virtual host in your hosting panel). If the snippet includes commented administrator-auth lines, add those inside your existing administrator location so your PHP/FastCGI settings stay unchanged.
• Test the Nginx configuration, then reload Nginx. Repeat this each time you enable or disable a restriction feature.
• Optionally, under Generated include file, click Copy include line and add it inside the same server { } block. JoomShield keeps this generated file in sync whenever you save restriction settings, but you still need to reload Nginx after each change.
• After you disable Emergency Site Offline or Administrator Access Protection, replace any previously pasted JoomShield Nginx rules with the current snippet, or reload Nginx if you used the include file. PHP protection stays active either way.

Step 9: Notification and Alert Settings

• Navigate to the Notification/Alert tab.
• Email Notifications is a Premium Feature that lets you Notify Administrator if IP address is blocked at the administrator email you enter, and Notify users for unusual activity with their account.

You have successfully configured miniOrange JoomShield, securing your Joomla site's login, registration, and admin access against unauthorized attempts.