Fingerprinting Protection
The Fingerprinting Protection tab adds .htaccess rules that prevent attackers from identifying the server software, PHP version, and other technical details of your installation. Reducing information disclosure makes it harder for attackers to target known vulnerabilities in specific software versions.
The warning on this tab is important: fingerprinting protections are applied via .htaccess and can interact with other server-level configuration. Test your site after enabling each option.
Options
| Option | Description |
|---|---|
| Disable Server Signature | Adds ServerSignature Off and related directives to hide the web server version string from HTTP response headers and error pages. |
| Disallow PHP Eggs | Blocks access to PHP information disclosure endpoints (?=PHPE9568F34-D428-11d2-A769-00AA001ACF42 and related "PHP Easter Egg" URLs) that reveal PHP version and logo information. |
| Disallow Sensible Files Access | Blocks direct browser access to a configurable list of files that should not be publicly accessible, such as htaccess.txt, configuration.php, joomla.xml, README.txt, web.config.txt, and others. The file list is editable in the text area. |
The Disallow Sensible Files Access text area contains one filename pattern per line. The default list covers the most common Joomla files that expose version or configuration information. You can add or remove entries as needed for your site.
When a rule has been written to the .htaccess file, a green check-mark icon appears next to the option label.
