14
In your header you have a canonical link (on line 11, just under <title>).
It looks like this on your page:
<link href="http://escene.ir/component/products/?task=view.12" rel="canonical" />
This element tells Google your preferred URL for a page which has several urls to choose from. This is to prevent you from being penalized for having ...
11
This is a Joomla 0 Day Attack. Information found here: https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html
This is not a vulnerability test despite the __test. It is an attack.
Make sure that any Joomla install is as up to date as possible.
Another option is to simply use .htaccess to intercept this exploit by looking for ...
5
To use safe_mode, set your database host, username and password in php.ini using the configuration parameters:
sql.safe_mode = On
mysqli.default_host = "127.0.0.1"
mysqli.default_port = "3306"
mysqli.default_user = "root"
mysqli.default_pw = "Password123"
By having it configured there you will not need it in your PHP scripts - enabling you to update your ...
5
Rule number 1... never ever share passwords
Sharing username and passwords is considered a bad practice, should it be for internet banking, social media or SQL databases, never use the same password and preferably use a different username. Sharing one password means they only need to hack one password and the vault is open.
Investigate how they got in...
...
4
I guess a 301 redirect is certainly not an option since the whole site structure will be different.
But if you are coming from Joomla to WordPress, the site structure will be predictably different and thus 301 redirects are both feasible and desired. As you can see in this other question, it doesn't have to be all that complicated of a rule to accomplish ...
4
I'm assuming that the bind.php file is not actually a part of Joomla, but rather a malicious script that the hacker uploaded to your site. In particular, just looking at the request parameters, it appears likely that the script is being used to send e-mail spam, possibly using someone else's hijacked e-mail account.
Here's what the request parameters in ...
4
Can I use the same MySQL database which is being used for joomla site?
Of course. There is no technical reason why you can't. As long as there is no conflict in table names, which as you noted can be overcome with table prefixes, they can happily coincide.
Is this a good practical decision for a small site?
Sure. This is quite common.
However, if you ...
4
All the answers suggested I would do as well. If you want another level of security I would enable Apache Basic Authentication
http://httpd.apache.org/docs/current/howto/auth.html
with a username/password on your admin URL within Joomla (make sure that this URL is https accessible only). This is done within your httpd.conf file whereby you generate a ...
4
The IP address that you linked does not resolve to a Google hostname therefore it is not Google. The person or bot is scanning your site for vulnerabilities. The first one is attempting to find a Joomla vulnerability.
These events are a regular occurrence on most websites, You should ensure that you are following best practices and harden your website, the ...
4
How could someone facilitate this?
Compromising any part of the PHP/Joomla/Plugin code could be enough to implement such a redirect.
However, these attacks are commonly achieved by writing malicious code to the .htaccess file that then checks the HTTP Referer and redirects the user visiting from the Google SERPs.
Would taking control of the Google ...
3
User agent wget
Blocking the user agent wget will block operating systems that use wget to download files within the terminal i.e Linux, MacOS, Arm etc. This will block every file from being downloaded using wget example.pdf.
But why block wget?
There's no right or wrong to this question but generally webmasters want site visitors actually visiting their ...
3
If it helps at all the CIDR range converts to:
103.22.200.0-103.22.203.255
3
You are 303 redirecting to a login page which then redirects back:
$ curl --head http://gsa.ece.umd.edu/
HTTP/1.1 303 See other
Date: Sun, 25 May 2014 10:45:59 GMT
Server: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4
X-Powered-By: PHP/5.4.21
Set-Cookie: c32b08af5ad5c16062381828f6a1b64e=6d66a9870a7067c444930d8deb190cd9; ...
answered May 25 '14 at 10:49
3
I don't know much about the newest versions of joomla, but looking this up on the web shows that some features of the admin portal are hard-coded to the default admin URL. People recommend password protecting the admin directory through .htaccess for better security. The other option is to use extensions, but as a general rule I hate using extensions to ...
3
You've made the redirect correctly. It works well. However you must wait until Google recrawl and reindex it before it appears on search results.
3
You can specify page titles in "Parameters (System)" in the menu item.
Joomla 1.5.9 is very old now and you should at least update to Joomla 1.5.26 and install applicable Security hotfixes for Joomla EOL versions.
Ideally you should be thinking about migrating to Joomla 2.5 or Joomla 3.2.
3
Honestly you are better off removing everything from your robots.txt. As far as I can see, all PHP files in Joomla contain the line
defined('_JEXEC') or die;
Which means if you load a PHP file directly in the browser all you get is a blank file, which search engines will ignore. (They shouldn't ever come across these anyway unless you linked them directly.)...
3
Your web server contains a configuration file with a configuration that directs traffic from certain sources to pages with the suspicious script.
If you're using apache, start with the .htaccess files in your document root folder and every folder recursively within it.
Look for any lines containing "user_agent" or "remote_addr" or even google or other ...
answered May 21 '15 at 16:40
Mike -- No longer here
13.5k4 gold badges22 silver badges53 bronze badges
3
So, it's the same old story.
But, first, there are few things to do:
Firstly, scan your site with some antivirus tool. Then do this:
Upgrade all components/plugins
Upgrade your Joomla on latest version
Limit the upload of files only to allowed extensions (e.g. .pdf, .doc, .docx)
Maybe put some additional stuff before upload (let's say captcha or some ...
3
There are a lot of places where a little tiny code can be implemented that does the job!
Here are my suggested steps to take towards fixing the issue:
You may find out where is that code exactly written by opening your
joomla folder(ftp, sftp) and checking your last modify date of the
folders > files. This way you may find where is the bad code!
I would ...
2
They should get delivered to you by email. It sounds like you may not have properly set up the "contact" for your contact form. Here is a YouTube video tutorial that walks you through the entire process: http://www.youtube.com/watch?v=FEK3JxqTxRQ
answered Dec 5 '13 at 11:29
2
As George Okello said, you have to notice the First page's Id. Go to Menu Manager and find them out for each language. There must be a different configuration if you have a plugin for multilingual websites.
in my case both ids were 127 and 128. So the solution is to put the following code before the <jdoc:include type="head" />.
<?php
$...
2
You can find the core Joomla 1.5 file structure at: https://github.com/PhilETaylor/Joomla1.5.999
When migrating to a new version of Joomla, I usually create the /new sub-folder and create the new website in here. Once the new website is ready to go live, it is quite simple to move everything in the root folder except /new into /old and then move everything ...
2
Ask customer to backup and download the old site (Very important as a legal stand point).
Look at Joomla's SQL details within configuration.php and take note of details.
Delete contents of public_html or www.
Upload new site to same location.
If new site uses a DB then use same details obtained from configuration.php with a different prefix.
If you get ...
2
As I understand it, the global settings version caches the views and parameters of components and modules, rather than the content. This means that if you change the content, then the change will be instantly visible to users.
However, this method of caching may not be a feature of third-party components (Joomla states here: Component developers have to ...
2
The process of migrating Joomla 1.5 to 2.5 is often a complex process, depending on what extensions you have on your current website. It's seldom a one-click process.
First of all, make sure you have a complete backup of your site (I recommend Akeeba Backup)
There are several ways to do the migration, and several tools that claim to be a one-click solution....
2
I'd probably run a crawler to collect all the URLs of your 1.5 site (a sitemap generator, or link checker should do this for you).
When the site is live, Joomla 2.5 has a redirect manager (under components) which lists all the URLs which have thrown a 404.
You should use the redirect manager to set up 301s on all the pages you know have changed.
If you ...
2
Yes, this bot is trying to exploit JCE. It’s probably using a very powerful publicly available exploit (+ mirror) for JCE < 2.0.11. Although this is a really outdated version, many instances are still in the wild. JCE 2.0.11 was released on 2011-08-29, the exploit has been available after the release (if its author kept his word).
If JCE is not installed ...
2
Apart from the overall use/lack thereof, of robots.txt in a well managed Joomla site, with "good" third party extensions — the only places that should contain CSS, JS or images are:
/images
/media
/templates
and of course their sub-directories.
So, you could just remove those from robots.txt.
2
In Joomla 3.3, these lines have been removed from the robots.txt file :
Disallow: /templates/
Disallow: /media/
More info here : http://www.energizethemes.com/blog/joomla/have-you-updated-the-joomla-robots-txt-file.html
Only top voted, non community-wiki answers of a minimum length are eligible