Session Protection
The Session Protection tab configures three related security features: session integrity protection, failed login tracking, and admin login controls.
All session protection options require that Joomla shared sessions are disabled in Joomla Global Configuration (System > Sessions). If shared sessions are enabled, a warning is shown and session protection options cannot be configured.
Session Protection
| Option | Description |
|---|---|
| Session Protection Active | Validates the client IP address and user agent at every page request for logged-in users. If either changes, the session is invalidated. |
| Session Hijack Protection | Detects when a session identifier is used from a different IP address or user agent than the one that created it. |
| What to Check | Determines what triggers a hijack detection: IP OR User-Agent (either mismatch triggers the alert) or IP AND User-Agent (both must change). |
| Protected User Groups | Multi-select list of Joomla user groups for which session protection is enforced. Leave all unselected to protect all logged-in users. |
Failed Logins
| Option | Description |
|---|---|
| Track Failed Logins | Records failed login attempts in the firewall log. |
| Logins to Monitor | Which login areas to monitor: Both Frontend and Backend, Frontend Only, or Backend Only. |
| Write Log | Writes failed login attempts to the firewall log with the FAILED_LOGIN_ATTEMPT_LABEL tag. |
| Action on Failed Login | What to do when a failed login is detected: Do Nothing or Add IP to Dynamic Blacklist. |
Admin Logins
| Option | Description |
|---|---|
| Email on Backend Login | Sends an email alert to the administrator each time a successful backend (administrator) login occurs. |
| Forbid Admin Frontend Login | Prevents users in administrator-level groups from logging in via the Joomla frontend login form. Forces them to use the backend URL. |
| Forbid New Admins | Prevents creation of new Joomla user accounts with Super User or Administrator group membership directly from the frontend registration form. |
