Forum

Hugo,

I recently had a joomla site hacked, which caused hours of frustration.

I need to Deny when a directory AND its subdirectories are in the url with a php extension being called.

Example:
/components/anything.php
/components/com_login/login.php

There are .js and images that must be allowed to be served so I can't use a simple Deny all.

Please help. This is very important.

Thank you,
Chris

How about using this UrlToolkit rule:

UrlToolkit {
  ToolkitID = deny_php
  Match ^/components/.*\.php DenyAccess
}