Security & backups
8 answers. Back up, keep your site safe, and what to do if it is hacked.
- How do I restore a backup?
Upload the .jpa file and Kickstart to your server, open kickstart.php in the browser, and follow the steps.
- How do I turn on two-factor login?
Edit your user account → Multi-factor Authentication: pick an authenticator app or a passkey and follow the steps.
Security - How do I find out about security updates?
Joomla emails super users when an update is out. You can also follow the Joomla Security Centre (developer.joomla.org/security-centre).
Security - How do I back up my Joomla site?
Install Akeeba Backup (free), click Backup Now, and download the .jpa file. Keep copies off your server too.
- My site was hacked. What do I do?
Take it offline, restore a clean backup from before the hack, update Joomla and every extension, and change all passwords. Then check for admin accounts you don't know.
Security - How do I keep my Joomla site secure?
Update Joomla and extensions as soon as updates come out, turn on two-factor login for admins, remove extensions you don't use, and back up regularly.
Security - Which file permissions should my site have?
Folders 755, files 644. configuration.php can be 444 (read-only) once your settings are done.
Security - Should I hide or rename the administrator folder?
You can't rename it, but you can protect it with a password in your hosting panel or a secret URL from a security extension.
Security
