Archive for the ‘Joomla’ Category

Rochen Annual Roundup

Posted By: Chris Adams, Date: Friday, December 11th, 2009

Although I won’t be covering everything from the past year, I am writing a quick blog post to update you on a few recent items. You may also wish to check out our 2009 blog archives.

KSplice Uptrack
As those of you who follow us on Twitter (@rochenhost) may already be aware we signed an agreement with Ksplice Inc. in October to deploy their Uptrack technology across all of our servers. Uptrack allows for seamless Linux Kernel updates without the need to reboot our servers, resulting in improved service and uptime for our customers. This is especially beneficial for customers using our Managed Virtual Server (MVS) service where Kernel reboots could take some time to complete. We are offering this service at no extra charge.

I am pleased to report that Uptrack is now successfully deployed and operational across the vast majority of our servers and we will have rollouts to all servers fully completed by the end of December. You can read more about Uptrack and how it will benefit our customers in the official press release here: http://www.prweb.com/releases/rochen-ksplice/rebootless-technology/prweb3069574.htm

Joomla Day in Viet Nam and Joomla Developer Conference in New York City
Brad Baker from Rochen’s team, who is also a volunteer member of the Joomla team, attended Joomla Day Viet Nam in Ho Chi Minh City on 1st November. Brad delivered a keynote address to the gathered community members on Joomla hosting and security. Brad reported back to me that the enthusiasm about Rochen and our services was strong, so we look forward to continuing to grow our customer base in Viet Nam through 2010. As one of the fastest growing centers for technology in the world, we believe Viet Nam is going to emerge as a market of growing importance for us.

Brad Baker prepares (center seated) prepares to deliver keynote.

Brad Baker (center seated) during Q&A session in Ho Chi Minh City.

Martin Rouf from our team and I both had the pleasure of attending the first Joomla Developer Conference this past weekend, held at Columbia University in New York City. On the first day of the conference Rochen made an announcement along with one of our customers, PICnet Inc, that we would be jointly contributing $10,000 USD towards the new Joomla Sponsorship Program.

Rochen believes contributing to Joomla in this way is the right thing to do for our customers as many of them use Joomla within their businesses, especially our reseller hosting clients. We also believe this announcement will benefit the wider Joomla community, even those who are not customers of Rochen. You can read more about this announcement and the sponsorship program in the official press release here: http://www.prweb.com/releases/joomla-hosting/sponsors-rochen-picnet/prweb3302454.htm

Chris Adams (right) prepares to speak at Joomla Developer Conference.

Chris Adams (right) prepares to speak at the Joomla Developer Conference in New York City.

Rochen was the lead sponsor of both events in Ho Chi Minh City and New York City.

UK Hosting
It has now been almost 6 months since we launched our UK hosting services, giving customers the choice to host on either a US or UK server with Rochen and pay in either US Dollars or British Pounds. Whether a customer chooses our US or UK location they will benefit from the same great customer support backed by enterprise services like Rochen Vault Managed Backups, in the knowledge that the entire service, including the physical servers and switches, are owned and managed by Rochen’s experienced engineers.

Based on the research we did before we launched the UK service we knew it was going to be successful, but it has outperformed all of our expectations. We were going after two key groups with the new UK service. Those targeting their website towards a UK or European audience and needed solid rankings in Google UK, Google Spain and other such indexes; and European businesses storing data that can’t be located outside of the EU due to data protection laws.

When we launched our UK hosting operation we did so completely out of existing cash reserves, so did not take on any debt. Today the operation is now cash flow positive and turning a nice profit. It is in fact the fastest growing area of our business ahead of our US hosting offerings, so we are extremely pleased with the outcome so far. Rochen is fully committed to both the US and UK / European sides of our business going into 2010 and beyond. It is important not only to look at the technical side of things when considering a web host, but the financial too. Rochen believes in steady and controlled growth that doesn’t result in a compromise of our high service standards.

VAT Rate Change
Starting in December 2008 the UK Government lowered the rate of Value Added Tax (VAT) from 17.5% to 15% to help with the economic situation. Some businesses did not pass this rate cut along to their customers and simply pocketed the extra 2.5% themselves as additional profit. Here at Rochen we passed along this rate saving from day one to our customers. As previously announced by the UK Government the rate will return to the 17.5% level on 1st January 2010 and as such the rate Rochen charges our customers will return to this level as well. Rochen only charges VAT to customers located within the European Union (EU), with a few exceptions.

Discount Promo Code
If you are not already a customer and are looking for some rock solid hosting this holiday season you can signup using the promotional code: XMAS and this will offer you 15% off your first invoice with Rochen. This code is valid through until 31st December 2009 and can provide even greater savings when paying annually with applicable plans. This beats any other public promotion we are currently running.

Finally, thank you to all of our customers’ through this year. I truly appreciate your loyalty more than you know. We have a lot of exciting developments in the pipeline for 2010. Everyone at Rochen wishes you a Merry Christmas and a Very Prosperous New Year.

- Chris

Chris Adams is the Founder and CEO of Rochen Ltd.

Share this blog post with your friends and colleagues:
  • Digg
  • Sphinn
  • Google
  • Facebook
  • Reddit
  • del.icio.us
  • LinkedIn
  • Slashdot
  • TwitThis
  • Mixx
  • Live
  • E-mail this story to a friend!

Rochen Staff and more JoomlaDay Events

Posted By: Brad Baker, Date: Tuesday, October 20th, 2009

Rochen keep in touch with their customers and the wider Joomla Community through our support and attendance of JoomlaDays and Joomla Events around the world. We try to keep our clients informed via our Twitter stream: @rochenhost make sure you follow us.

Recently on the list of events we attended and supported was the Sydney JoomlaDay 2009.
Thanks to all the people behind this event, the day was both informative and enjoyable. I was able to meet up with a number of current customers (and hopefully future ones) and discuss with them their needs and plans for the future. Here’s a small picture I took at the end of the event: http://yfrog.com/0sdfqj If you attended this event and missed the coupon code we shared, please get in touch with me.

Later in the year we’re proud to be providing support to the Joomla! Developer Conference in New York City on Dec 5 and 6 2009.

Other JoomlaDays currently being planned in 2010 that we will also attend include: Melbourne JoomlaDay 2010 and CMS Expo 2010. We may be able to have more than one staff member present at some of these future events as we try to contribute to the Joomla Community by sharing our knowledge and services of Joomla Hosting, afterall, we know how to host Joomla sites being the Official Hosting Partner of the Joomla Project.

In the nearer future, you can catch us in Vietnam at the JoomlaDay Ho Chi Minh City on November 1 2009. We’re not only attending this event, but also providing sponsorship.

If you have any questions regarding your hosting needs (present and future) and you can attend any of these events, be sure to let us know and we’d be happy to arrange to spend some time with you.

- Brad

Brad Baker has been a member of the Rochen team since early 2003 and is a founding member of the Joomla! Open Source Project. He currently is part of the Joomla LeadershipTeam, and also blogs here.

Share this blog post with your friends and colleagues:
  • Digg
  • Sphinn
  • Google
  • Facebook
  • Reddit
  • del.icio.us
  • LinkedIn
  • Slashdot
  • TwitThis
  • Mixx
  • Live
  • E-mail this story to a friend!

Reminder: Keep Your Joomla Sites Updated and Secure!

Posted By: Brad Baker, Date: Friday, September 11th, 2009

Brad Baker

I can’t hold back any more, I’m seeing still, so many people who do not keep their Joomla sites up to date, and then end up being exploited/compromised and cause more stress to themselves.. so.. again.. please Keep Your Joomla Sites Updated and Secure!

A simply way to do this, and with minimal effort is to use this great free component: Update Manager for Joomla! – Joomla! Extensions Directory – it will enable you to update your site, all from your Joomla backend. What could be easier?

BTW It’s not just Joomla that needs to be kept up to date, but any scripts you run. Joomla, along with scripts like Wordpress are very popular and as a result attract the ’script kiddies’ and others who once a patch is released, work out how to scan for compromised sites and exploit … YOU.

So, avoid being blacklisted by Google, avoid the downtime and pain involved with recovering from a site compromise, and simply Keep Your Joomla Sites Updated and Secure!

If you are in the unfortunate situation where you’ve been ‘driving a racing car without a helmet or seatbelt’ aka not bothering to Keep Your Joomla Sites Updated and Secure and your site has been compromised, please see the following articles: How do I use Rochen Vault? and My site has been compromised, help!

- Brad

Brad Baker has been a member of the Rochen team since early 2003 and is a founding member of the Joomla! Open Source Project. He currently is part of the Joomla LeadershipTeam, and also blogs here.

Share this blog post with your friends and colleagues:
  • Digg
  • Sphinn
  • Google
  • Facebook
  • Reddit
  • del.icio.us
  • LinkedIn
  • Slashdot
  • TwitThis
  • Mixx
  • Live
  • E-mail this story to a friend!

Joomla Days in the USA, UK and Australia and Rochen’s Las Vegas Party! Joomla hosting and security on the agenda.

Posted By: Chris Adams, Date: Sunday, April 12th, 2009

Some members of the Rochen team have had the pleasure of attending and being the lead sponsor of three Joomla community driven events over the past few months. In addition to providing all of the joomla hosting services for the official Joomla websites, Rochen also sponsors many community organized events  around the world called Joomla Days.

Sponsoring Joomla Days  gives Rochen another way to help support the Joomla project and wider open source community as well as affording us a great networking opportunity to link up with both current and potential clients in the Joomla community. Meeting up in person adds an extra layer of value, although one that is hard to measure in pure dollar terms from a business prospective.

Brad Baker from Rochen’s team, who is also a member of the Joomla Core Team, attended Joomla Day Melbourne on February 7th and Martin Rouf and I attended both Joomla Day UK in Maidstone, Kent on March 13th and 14th as well as Joomla Day Las Vegas on April 4th. Rochen was the lead sponsor of all three events providing financial and logistical support to help keep the costs down for attendees.

Joomla Day Melbourne
Brad delivered a keynote presentation at the Melbourne Joomla Day on joomla security covering both the basics and more in depth steps you need to take to secure your Joomla site. It is worth pointing out that if you are hosting at Rochen then a lot of the security ground work is already done for you and you will not run into issues like file ownership or permissions problems here.

The organizers of Joomla Day Melbourne have not yet got the video of Brad’s presentation up, but you can watch his 2008 keynote here.

Brad Baker speaking at simliar Joomla Joomla event in Vancouver. Sorry, we had no pictures of Brad from Melbourne. If someone has one please send it over :-)

Brad Baker speaking at similar Joomla event in Vancouver. Sorry, we had no pictures of Brad from Melbourne. If someone has one please send it over.

Joomla Day UK ans Las Vegas
At the the Joomla Day in the UK I delivered a presentation to the whole group detailing the type of traffic Rochen handles for Joomla across the official sites (23 million page views for February 2009, in case you were wondering!) as well as some of the ‘cool’ things we are doing here at Rochen like our Rochen Vault Managed Backup system and our recent move into the green hosting arena. Both in the UK and Las Vegas Martin and I hosted a round table Q&A session on Joomla security answering people’s questions and addressing some of their concerns.  Rochen even managed to pick up a few new hosting and reseller hosting clients from the sessions which was pretty neat.

Chris Adams speaking at Joomla Day UK in Maidstone, Kent.

Chris Adams speaking at Joomla Day UK in Maidstone, Kent. Nearly 200 people attended!

Chris Adams talking to group at Joomla Day Las Vegas.

Chris Adams talking to group at Joomla Day Las Vegas.

Rochen’s Las Vegas Dinner and After-Party!
To coincide with Joomla Day Las Vegas Rochen also organized a dinner at Valentino’s Fine Dining and an after-party at Tao Beach nightclub for any of our customers who wanted to attend as a way to say thank you for their business and also to gain valuable face-to-face feedback. We like to organize these type of events at least once a year and have hosted our customers in London, UK; Vancouver, Canada and  San Francisco, CA in previous years. In Las Vegas this year we had around 40 customers attend.

Rochen provided transportation to get our customers to dinner and the after party!

Rochen provided transportation to get our customers to dinner and the after party!

Rochen customers having dinner at Valentino's in the Venetian, Las Vegas.

Rochen customers having dinner in private dining room at Valentino's in the Venetian, Las Vegas.

Rochen hired a private outdoor cabanna at Tao Beach for the after-party.

Rochen hired a private outdoor cabana at Tao Beach for the after-party. We look after our clients!

Jamie Foxx stopped by Tao!

Jamie Foxx stopped by Tao!

Future Events?
We don’t have anymore Joomla Days on the Rochen calendar right now but we will keep customers posted via our forums when that changes. There is a good chance Brad will be attending an event in Vietnam later in the year and there is talk of a Joomla related event in New Orleans in late October. Likewise, we will keep everyone posted of the next Rochen dinner and after-party. Although not Joomla related Martin and I will be at HostingCon in Washington DC this August and PubCon in Las Vegas this November.

Special Thanks
That just leaves me with a few people to thank. Andy Wallace did a tremendous job with organizing Joomla Day UK, as did Toni Marie Swats with the Las Vegas event and Matthias Raab in Melbourne. Rochen provides the support we can for Joomla Days but these three people put hundreds of hours of work in to actually make these events happen with no financial return for themselves. Kudos to them all.

I also want to thank Allen Gunn (aka “Gunner”) from Aspiration for facilitating the Las Vegas event. I have been to two events that Gunner has facilitated now, the first being Joomla Day Mountain View at the Googleplex (Google’s HQ) in May 2007 and this event in Las Vegas. Both these events are amongst best I have ever been at. If you are looking for a facilitator for an open source event then drop Aspiration an email.

I want to give a quick mention to Matt Olander from IX Systems, Ryan Ozimeck from PICnet and Aaron St.George from The Uptime Institute for helping keep things on track at the Joomla Day and at the Rochen dinner and after-party. Aaron was our designated transportation coordinator towards the end of the night! Finally, a big thank you to everyone at Joomla and Rochen’s customers for making the trip to these Joomla Days and the Rochen dinner, we appreciate it more than you know.

So until the next Joomla Day and Rochen party…

- Chris

P.S. A lot of people at the events asked about Rochen’s Joomla security check list. You can find it here: Joomla Security Check-List.

Chris Adams is the Founder and CEO of Rochen, a web hosting provider specializing in providing a performance tuned hosting platform for dynamic database driven scripts like Joomla! Rochen has hosted all of the official Joomla! websites since the project began in August 2005.

Share this blog post with your friends and colleagues:
  • Digg
  • Sphinn
  • Google
  • Facebook
  • Reddit
  • del.icio.us
  • LinkedIn
  • Slashdot
  • TwitThis
  • Mixx
  • Live
  • E-mail this story to a friend!

Joomla! Events Rochen are Attending and Sponsoring. Joomla Hosting and Security.

Posted By: Brad Baker, Date: Monday, January 5th, 2009

This year is shaping up to be an even busier year than last year at Rochen. Our recently launched Managed Virtual Server (MVS) platform continues to be one of our most successful products from 2008 and we hope that to continue this year as well. Still in the pipeline for the near future is our Rochen ‘Exclusive’ Affiliate program that will be only open to selected applicants. Look out for more information on that soon.

Joomla Events where you can meet some of the Rochen team:

Melbourne JoomlaDay – Sat 7th February – Sun 8th February 2009
I’ll be attending this event, along with some other Joomla Core Team and Workgroup members. Look out for my presentation on Joomla Hosting, as well as others on the day regarding Joomla Security.

UK JoomlaDay – Sat 14th March – Sun 15th March 2009
Chris as well as Martin will be attending this event. This is only the second UK JoomlaDay, so I’d expect it to be a sold out event. Chris will also be speaking on Joomla security from a web hosting prospective. In the mean time you may wish to review his previous blog post on Joomla Security.

Las Vegas JoomlaDay – Sat 4th April 2009
Chris will be attending this event, and it’s shaping up to be one of the biggest Joomla Events of the year. Some of the presenters include: Steve Burge, Vic Drover, Andrew Eddie, Anthony Ferrara, Louis Landry, Toni Marie, Jennifer Marriott, Wendy Robinson, Rob Schley and Elin Waring.

Rochen do more than just Joomla hosting. We try to support Joomla as much as we can by not only our sponsorship of the project, but also of JoomlaDays.

Which events will you be attending this year? We be happy to catch up with any current or potential customers while we attend these events.

We’re looking forward to seeing some of you there!

- Brad

Share this blog post with your friends and colleagues:
  • Digg
  • Sphinn
  • Google
  • Facebook
  • Reddit
  • del.icio.us
  • LinkedIn
  • Slashdot
  • TwitThis
  • Mixx
  • Live
  • E-mail this story to a friend!

Rochen, now proudly hosting JoomlaPack. Make migrating your site to Rochen even easier.

Posted By: Brad Baker, Date: Wednesday, November 5th, 2008

Rochen is proud to announce our sponsorship of the JoomlaPack project. JoomlaPack is an invaluable tool for helping migrate your Joomla sites and we’re proud to be providing the joomla hosting for this great project. If you have ever tried it out before, I am sure you would agree that it is one of the most professional and polished tools available for Joomla. As well as that, it makes moving a Joomla website a breeze.

It is also an Editors Pick on the Joomla! Extensions Directory with many rave reviews.

So join us in welcoming the JoomlaPack team to Rochen. We look forward to working with them on into the future, and hope that their tool proves useful to many of our clients as well.

If you are not yet familiar with their free tool, be sure to head on over to their site and check it out.

About Joomlapack

JoomlaPack is an open-source backup component for the Joomla! CMS, quite a bit different than its competition. Its mission is simple: create a site backup that can be restored on any Joomla!-capable server. It creates a full backup of your site in a single ZIP archive. The archive contains all the files, a database snapshot and an installer derived from the standard Joomla! installer. The backup and restore process is AJAX powered to avoid server timeouts, even with huge sites. Alternatively, you can make a backup of only your database. If you want a reliable, easy to use, open source backup solution for your Joomla! site, try it out.

- Brad Baker

Brad Baker has been a member of the Rochen team since early 2003 and is a founding core-team member of the Joomla! Open Source Project. He also blogs here.

EDIT: Please note, JoomlaPack has changed their name to: AkeebaBackup and moved to a new site: www.akeebabackup.com Please update your links accordingly.

Share this blog post with your friends and colleagues:
  • Digg
  • Sphinn
  • Google
  • Facebook
  • Reddit
  • del.icio.us
  • LinkedIn
  • Slashdot
  • TwitThis
  • Mixx
  • Live
  • E-mail this story to a friend!

Slow load times? Poor performance? The real word problems behind “overselling”. Don’t panic though, Rochen can help!

Posted By: Chris Adams, Date: Tuesday, October 21st, 2008

If you have browsed around different hosting companies websites you are bound to have come across at least one that either offers unrealistic amounts of disk space storage or data transfer and then conceals what they really do offer through clever jargon in their legal agreements. Some providers have even gone as far as advertising “unlimited” disk space and “unlimited” bandwidth in an effort to pull in unsuspecting customers. In the industry we refer to this practice as overselling.

The keyword here though is advertising. That’s really all these oversold providers are doing. They are advertising (falsely in my opinion) something they can’t actually deliver. If a provider is advertising 750GB of disk space and 10,000GB of data transfer (or worse “unlimited”) for $8 per month, as an example, then something is not right. It is not possible for a provider to buy resources this cheaply and then once you factor in other outgoings like the servers themselves, support engineers and other costs of doing business it just doesn’t add up. Both disk space and bandwidth are a finite resource like anything else. Disk manufactures like Seagate and Maxtor have not designed hard disks with unlimited storage yet. Bandwidth providers such as InterNAP and Level 3 have not worked out a way to push unlimited data down their pipes yet.

False advertising is not the biggest issue here though. The biggest problem is that these practices impact your website load times and its overall performance. These providers are counting on the fact that the vast majority of users on a server will not consume the advertised amount of disk space or bandwidth and the few that do will be offset by the other paying customers. This is partly true but it does not stop very serious problems from occurring. By allowing a few customers to use these levels of disk space and bandwidth in a shared environment it can cause major stability problems for everyone else on the server. Their shared servers end up drastically overloaded which then hits your site load times. Worse still, they might just cut you off if you use too much yet you are still within their advertised limits.

There are two main reasons that many hosting providers manage to get away with these dubious practices -

  • Through no fault of their own the average consumer of web hosting services simply isn’t educated enough and when they see these falsely advertised plans they think “fantastic, that’s a great deal” and they go ahead and purchase. If I didn’t know any better then I would probably do the same thing. That’s one of the reasons for this blog post to hopefully try and spread the word. Education is king.
  • Due to the web hosting industry not only spanning across many states and territories but the entire globe there is little to no regulation on the way many providers advertise their service. There is no one to turn around and tell these providers what they are doing is unethical. Some of the providers doing this are well known brand names and huge multi-million dollar corporations.

Our aim at Rochen has always been to provide our customers with ample resources to run their website and provide seamless upgrade paths as they grow while not falsely advertising our service. Rochen not overselling is a huge benefit our customers have but it is also our heavy investments in infrastructure and systems like Rochen Vault that set us apart. Rochen’s commitment to proper, no nonsense, 24/7 support backed by certified engineers is another big selling point.

Speaking of Rochen Vault, I will try and blog in more detail about this another day, as it truly is a fantastic system that allows you to easily restore files or an entire account to points in time over the past 30 days. If you have had a problem with a script upgrade, mistakenly deleted a file etc. Within a matter of a few seconds you can have your site recovered and back online. Back to overselling and performance for now though.

We often get emails from users looking for Joomla hosting and web hosting services for other types of dynamic scripts (PHP / MySQL driven mainly) and they tell us that things are running slow with their current host. Nine times out of ten this is due to the fact they are hosting with one of these oversold providers and as soon as they move their website over to Rochen it is like it receives a new lease of life. All of our plans come with a full 15 day money back guarantee, so you can try this theory out for yourself completely risk free.

Rochen’s primary target market is those users looking for a truly performance driven hosting platform where their sites will load fast and they will not have many of the common hosting hassles they would with other providers. Whether it be a personal homepage, business site or providing reseller hosting for your own customers we likely have a solution for you. If you are not sure what you are looking for then drop us an email via sales@rochen.com and we will be happy to have a chat with you. If Rochen reverted to the ways of some of these providers then we would lose our core user base who demand performance at reasonable prices.

Before signing up with any provider examine their offering in great detail, see what added-value services they offer (e.g. Rochen Vault), see what their track record in the industry is like (Rochen has been around for over eight years) and see if they are misleading you with a hugely oversold offering. Also, try and calculate how much disk space and data transfer you actually require. This can often be tricky, but using Joomla as an example again, you can deploy a good sized Joomla site, store a good chunk of email and still have space left over out of 200MB disk space. In a lot of cases we see users vastly overestimating the amount of disk space they need to get started. Remember, as your site grows you can easily upgrade.

So join with me in saying yes to performance driven hosting and no to the misleading oversold plans. Thanks for reading and I hope you find this information useful.

- Chris

Chris Adams is the Founder and CEO of Rochen, a web hosting provider specializing in providing a performance tuned hosting platform for dynamic database driven scripts like Joomla! Rochen has hosted all of the official Joomla! websites since the project began in August 2005.

Share this blog post with your friends and colleagues:
  • Digg
  • Sphinn
  • Google
  • Facebook
  • Reddit
  • del.icio.us
  • LinkedIn
  • Slashdot
  • TwitThis
  • Mixx
  • Live
  • E-mail this story to a friend!

Joomla! Security – Ever been hacked? Sorting fact from fiction. Useful security tips for Joomla! users.

Posted By: Chris Adams, Date: Friday, September 19th, 2008

Firstly, welcome to the Rochen Blog and our inaugural post. I am not sure where this blog is going to take us or what topics we will cover, but pretty much everything is on the table. With this first blog I thought it would be a good idea to cover a topic on the minds of many people – Joomla! security.

I think it is fair to say that Joomla! has received a lot of unjustified and misinformed criticism from many in the web hosting community. In my opinion the main reason for this is that when a Joomla! powered website is hacked on a host’s server then the vast majority of providers automatically assume the problem lies with Joomla! itself (because that’s what the site is running) and immediately tag it as a script with a lot of security problems without any proper research. Some hosts have even gone as far as banning Joomla! from their servers.

From our own experiences here at Rochen we have found that the vast majority of security issues that come up with Joomla! sites are nothing to do with the core code released by Joomla! themselves but due to poorly coded, insecure or out of date third-party extensions that are installed under Joomla. Even if your Joomla install is kept fully updated but you have a single insecure extension installed then this will allow your entire site to be compromised. Vulnerable extensions are lethal to your site security.

As you might be aware Rochen know a thing or two about Joomla hosting. We host thousands of Joomla! powered websites but we also host all of the Joomla! official sites at www.joomla.org as well. We hosted the very first install of Joomla before any other provider. So I have put together a few recommendations based on things we have seen at Rochen that will hopefully help you keep your Joomla site more secure. Hosting with Rochen never hurts, but these tips are not specific to us.

1. Host your site on a server that runs PHP in CGI mode with su_php. This means that PHP runs under your own account user instead of the global Apache user and you don’t need to set insecure global permissions like CHMOD of 777. Not having PHP configured in this way opens you up to cross-account attacks from other users on the shared server since you will need to CHMOD to 777 any directories Joomla! need to be able to write to. It also makes installing and managing extensions a real nightmare for the webmaster. A shameless plug, but in case you were wondering, yes, Rochen meets this requirement and we also performance tune all of our PHP installs as well for good measure.

2. Providing you are hosted on a server that runs PHP as directed above then you should ensure all of your files are CHMOD to 644 and directories to 755. You should never CHMOD any files or directories to 777, especially your configuration.php file.

3. The Joomla! FTP Layer was developed as a work around solution in case a user was hosting a site on a server that did not run PHP under the account user. It allows for extensions to be installed under Joomla without running into file ownership issues. Unfortunately, it also opens up a potential security hole since your FTP details are stored in plain text under a Joomla! configuration file. If you are hosting in a secured and tuned environment, like we have here at Rochen, then you don’t actually need the FTP layer to be enabled as extensions will install out of the box without any hassle and you can manage them without running into file ownership issues. You should disable the Joomla FTP Layer and ensure it has not stored your login details.

4. There was a security issue with Joomla reported around a month ago that allowed an attacker to reset the Joomla administrator password for a site. Although it is not a complete solution a really simple thing you can do to help protect yourself if an issue like this comes up again is to change your Joomla! administrator username. Change it from the default “admin” to something else like “chris.admin”. Make it that bit harder for an attacker to compromise your site.

5. Although it might be tempting to install every extension under the sun (there are a lot of wonderful ones out there and some not so great!) only install the ones you need. The more you install under Joomla! then the more likely your site is to be compromised. You should also ensure you remove any components (including the files themselves via FTP) for any extensions you are not using.

6. It might seem like an obvious one but ensure your web hosting provider is keeping up with their responsibilities. Ensure they are keeping PHP and other software on the server updated (nobody should be running PHP4 anymore as it is now “End of Life” and potentially open to security issues), ensure they are running their operations in a secure way (PHP in CGI mode with su_php as noted above) and ensure they are taking steps to help ward off attackers by running modules like mod_security under Apache and open_basedir under PHP. Having mod_security on your server can help to stop a lot of XSS attacks against your Joomla! install getting through, but it can’t stop them all so you still need to ensure you keep up with your Joomla! security updates.

7. Ensure you are setting secure passwords for both your Joomla! administrator user but also your web hosting account control panel and FTP logins. It would be a real shame to have spent lots of time securing your Joomla! install to then let an attacker in through a weak password. I recommend a password that is at least 8 characters in length and containers letters (both upper and lower case), numbers and at least one symbol. Also ensure your passwords do not contain dictionary words. Using a password generator is a good idea.

8. Another useful tip I can share with you is to password protect your Joomla! /administrator directory. You can do this under an Apache web server using a .htaccess file and if you are a Rochen customer this can be easily configured using the “Password Protection” option within your control panel. By password protecting the /administror directory you will have to enter a username and password prior to reaching the Joomla! administrator login page. It means that even if your Joomla! admin password is stolen then your site is still largely protected since the attacker will not be able to reach your administrator login page. Remember, it is important to use a diffrent password on the /administrator directory than you do for your Joomla! admin password or it defeats the purpose of doing this.

9. Last but not least, and probably most important, you need to ensure you keep your Joomla install itself fully updated with the latest security patches from Joomla. You also need to ensure you keep all of your extension installs updated too. Remember, even if your Joomla install is updated having even one insecure extension can allow your site to be compromised. You should subscribe to the Joomla Security Mailing List as well as the mailing lists maintained by the developers of third-party extensions you have installed. If you are using an extension from a developer that doesn’t maintain a security mailing list, then question them why. It is something all developers should be doing.

So, if you have read this far down the blog post, then you might be happy you did because I am pleased to provide you with a Rochen promotional code: joomlasecurity. Simply enter this during the Rochen ordering process and you will receive 15% off your first month’s hosting for any of our plans. This coupon is good through to the end of October 2008. We don’t issue many coupons, but when we do they will be in sneaky places like this. Who ever said reading blogs while you should be working wasted money?

One other thing worth mentioning. If your Joomla! site hosted at Rochen is hacked then you can easily roll your account back within a few minutes to points in time over the past 30 days using our Rochen Vault recovery system. Simply login, select the files you want to restore and boom – your site is rolled back to an unhacked state. You do of course then need to secure the site otherwise it will simply be hacked again, but if you follow what I have outlined in this post then your Joomla! powered sites being hacked should be a thing of the past.

If you have any comments, questions or better yet security tips of your own then please leave a comment under this blog. Thanks for reading and I hope you have found some of the tips useful.

- Chris

Chris Adams is the Founder and CEO of Rochen, a web hosting provider specializing in providing a performance tuned hosting platform for dynamic database driven scripts like Joomla! Rochen has hosted all of the official Joomla! websites since the project began in August 2005.

Share this blog post with your friends and colleagues:
  • Digg
  • Sphinn
  • Google
  • Facebook
  • Reddit
  • del.icio.us
  • LinkedIn
  • Slashdot
  • TwitThis
  • Mixx
  • Live
  • E-mail this story to a friend!