CG Secure component

1 1 1 1 1 Rating 5.00 (1 Vote)
(Reading time: 3 - 6 minutes)

User Rating: 5 / 5

Compat icon 3 x longfirst look joomla 4CG Secure component protect your Joomla forms and admin access by checking IPs from AbuseIPDB, giving country/spammer status.


Version 2.1.11 :update changelog file
Version 2.1.10 : cleanup update servers list
Version 2.1.8 :  plg_system_cgsecure : suppress notice if http
Version 2.0.1 : Joomla 4.x compatibility
Version 1.3.0 : Check Joomla Version
Version 1.2.0 : PHP 8.0 compatibility
Version 1.0.6 : first release (2019 October)

Donwload CG Secure Component For Joomla 4

(already downloaded 205 times)

Donwload CG Secure Component For Joomla 3.x

(already downloaded 745 times)


CG Secure component uses CG Secure and CG Country plugins, centralizing their parameters.

Important : When migrating to Joomla 4.0, CG Secure plugins are being disabled and enabled again by package update.

You may authorize one or more countries to connect to your admin/website. Any connection from another country must be a hacker trying to access unauthorized parts of your website.

For your information, even if you did not define any private access, any user may access to Joomla identification form by adding /index.php?option=com_users&layout=edit&id=0 to your website address. If you did not de-activate user registration (activated as default value in older Joomla version, prior 3.7.0), welcome to our open bar.

Once running, CG Secure protects /administrator using a password, after  checking IP's country code, spammer status in AbuseIPDB. It also hides forms to unwanted users.

IP is checked against AbuseIPDB database which returns country code and spammer status.

In case of an unauthorized country, you may report this IP to AbuseIPDB. You must register to AbuseIPDB to report an IP (it's free).

Banned Ips may be logged in cgipcheck.trace.log file in your logs directory. I use View Logs component to check my log files.

Rejected user won't even see your forms.

Banned IPs are also stored in your database (table #__cg_rejected_ip). They remain in your database depending on your "IP life time' parameter from your CG Secure configuration menu. You may see these IPs through CG Secure Logs menu.

1 component

3 plugins

1 library

Enter your plugins parameters in CG Secure component and look at blocked IP list.
  • Plugin System CG Secure (event onAfterDispatch) : check /administrator access (hacker trying to access your adlmin via /administrator address),
  • Plugin User CG Secure (event onContentPrepareForm): check IP before displaying Joomla forms(com_users, com_admin) (hacker connecting via Joomla forms)
  • Plugin Authentication CG Secure (event onUserAuthenticate) : if authenticate is done, check if IP can really do it (hacker trying to enter without using any Joomla forms, mostly php codes).
cgsecure/ipcheck.php library centralizes IP checking and reporting to AbuseIPDB.

Note : if you are using other forms components (VisForm, RSForm,...), you may easily write your own plugin to block unauthorized countries/spammers. Visforms uses onVisformsFormPrepare($context,$form,$params) event, RSform checks rsfp_f_onBeforeFormDisplay($array) event. If you need Visforms or RSFOrm plugin, just ask me, because I already prepared them.....

CG Secure version 1.1 introduces .htaccess security.

This only works with Apache 2.4.x server.

It has been created from  and AESecure. The difference from other solutions is to block found hackers (doing XSS attacks, SQL injection,...) at .htaccess level, so it stops attacks as soon as possible, keeping them away for the time defined in your IP life time parameter.

init htaccess
  • Multiaddresses : you have multiple addresses to access your website,
  • Subdir : your site is in a sub-directory.
param. htaccess

When activating, if you have no .htaccess file, CG Secure copies Joomla default htaccess.txt to your site root..

After saving current htaccess file, CG Secure adds its lines in .htaccess file from administrator/components/com_cgsecure/assets/cgaccess.txt file.

If you wish to use your own .htccess file, you may create a custom.txt file in the same directory than cgaccess.txt. Then, custom.txt will be used instead of CG Secure default file.

Attention: Working with .htaccess file may breaking down your site badly. Older versions of .htaccess files are saved in administrator/components/com_cgsecure/backup directory.

Note : Communication between .htaccess file and CG secure component are secured via a random number which is calculated each time htaccess security is actived. To create a new one, de-activate htaccess security, clicking No to Activate parameter, then, click on Yes, so you'll get a new security key. 

How access to your administration once CG Secure has been actived ?

Note: if you did not enter any password, administrator access is done as usual, IP checking is performed anyway.

  • HTTP Authentication: standard Apache authentication. You'll have to enter a password in "Password" field, "Username" field may remain empty as it's not checked, 
  • Compatibility: you'll have to enter — "yourpassword" being the password you entered in CG Secure plugin.


cgsecure config

Default CG Secure component behaviour protects Joomla connection forms (com_admin, com_users). If you wish to extend this to contact forms, just add com_contact to Components List parameter.

Entering * in Countries list will authorize all countries, but still check spammer status from IP address.

cgsecure config

You may define some IP addresses in your "whitelist", there won't be any check against those IP addresses.

cgsecure config

If you are a registred AbuseIPDb user, you may see your report history, in your user account, tab "Rerports.


Comment column shows reported hackers : 2 first letters from your website name,e = error/w = warning, followed by an error number if it's coming from .htaccess security, other errors being created by CG Secure plugins (Authentication, System, User).