Sensitive Files
Joomla configuration.php File Access Check
The configuration.php file contains Joomla database credentials. Verify it is not publicly accessible and learn how to secure it effectively.
What this test checks
This test checks whether the Joomla configuration file (configuration.php) is publicly accessible. This file contains database connection credentials, security settings, and encryption keys for your Joomla site. Its exposure allows an attacker to steal your data, modify configuration, or take full control of your site.
Our recommendation
Ensure that configuration.php is not accessible from the web. By default, Joomla places it at the site root, but you can move it above the public directory. Use restrictive permissions (chmod 644) and add a rule in your .htaccess to block direct access to this file. Regularly verify its accessibility by trying to access it via a browser.
Security tests
Read more
Header Security