Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A client of mine complained of an attack. I checked the access log and found a massive number of requests for the admin login page from seemingly random IP addresses. I created an .htacces file in the /administrator directory and populated it with the following (IP addresses obfuscated):

order deny,allow
deny from all
allow from #my IP address
allow from #my client's IP address

I then went to a free proxy server and typed in the URL for the admin page. The page didn't load any of the assets (images), but it did load the actual page itself.

Joomla! does some SEF stuff in the .htaccess file that is in the DocumentRoot. It looks like this:

## Begin - Joomla! core SEF Section.
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
# If the requested path and file is not /index.php and the request
# has not already been internally rewritten to the index.php script
RewriteCond %{REQUEST_URI} !^/index\.php
# and the request is for something within the component folder,
# or for the site root, or for an extensionless URL, or the
# requested URL ends with one of the listed extensions
RewriteCond %{REQUEST_URI} /component/|(/[^.]*|\.(php|html?|feed|pdf|vcf|raw))$ [NC]
# and the requested path and file doesn't directly match a physical file
RewriteCond %{REQUEST_FILENAME} !-f
# and the requested path and file doesn't directly match a physical folder
RewriteCond %{REQUEST_FILENAME} !-d
# internally rewrite the request to the index.php script
RewriteRule .* index.php [L]
## End - Joomla! core SEF Section.

I am guessing that the reason that the .htaccess file in the administrator directory isn't working properly has something to do with the main Joomla! .htaccess file. Is that true? I tried adding this to my main .htaccess file, but it resulted in a 500 error:

<Directory /var/www/vhosts/>
    order deny,allow
    deny from all
    allow from
    allow from

How can I effectively block all access to the administrator directory, excluding the two whitelisted IP addresses?

share|improve this question

Does the actual administrator page (probably PHP?) exist there, or is it just generated from something like index.php with a fake directory structure?

To simplify, try something like this (in your main config file, not .htaccess):

<Location /administrator>
  Order deny,allow
  Deny from all
  Allow from
  Allow from
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.