Block new user registrations.

Ralf Koehnsen · 2026-08-12T09:56:28+00:00

Ist es über HTProtect möglich, generell eine neue Nutzeranmeldung in Joomla zu unterbinden, so dass nur der eine Superuser dort präsent ist und es keinen anderen "User" möglich ist, ein neues Konto zu erstellen, im Sinne von "es kann nur einen geben"?

Ralf Koehnsen

Is it possible with HTProtect to generally block new user registrations in Joomla, so that only the one Superuser exists and no other "user" can create a new account, basically like "there can only be one"?

Reiner

Hey Ralf,
you can actually disable user registration right in Joomla itself, can't you?!
Backend -> Users -> Manage -> Options -> (TAB User Options) -> User Registration -> NO

Ralf Koehnsen

Hello,
that happened as well. Still, a user with the registration date 30.11.-0001 00:00:00 was created, and as far as I know, not through the dashboard, since there's only one user who can/could create other users there.
I also got a warning from HTProtect that the SuperUser (my account) got a new password and was downgraded—downgraded to an undefined state regarding the user group. The newly "created" user then had SuperUser privileges. Luckily, HTProtect also caught the password of the new user, so I was able to log in with it, reactivate my account, log in again, and disable the new one. Disabled because my deletion of that account was quickly undone, as the user was magically recreated afterward.
The user is still there now, but disabled. I'm going to add extra protection to the dashboard access now.

Pascal

Hi Ralf,

2.6.9+ now has protection against admin accounts sneaked in bypassing the Joomla user management.

These are now blocked immediately. At the same time, existing admin accounts are protected. Meaning: if the group membership—like in your case—is suddenly removed, it will be automatically reversed. Changes made the normal way via Joomla user management remain unaffected.

Luckily, HTProtect also catches the password of the new one, ...

The password isn’t exactly “caught.” You can log in via the dashboard as any active Super User—this creates a passwordless session for that user. The password itself is neither needed nor read.

Have you been able to find the cause of the changes on your end? Found any malware, is your database accessible from outside, or maybe a cronjob got injected?

Cheers
Pascal

Ralf Koehnsen

Thanks for your reply. I checked the user activities and the registration of the "new" user wasn’t recorded there. I also have no idea how that could have happened from the backend itself. My SuperUser had a very strong password, and I also set up extra protection with HTProtect. The content is hosted at IONOS and I have the customer data for it. I tried to log into the customer center, but the credentials didn’t work. On top of that, I couldn’t access the server via FTP anymore. Two signs that something was messed with in the IONOS backend and someone (in my opinion) added the user directly into the database via PHPMyAdmin. I asked the customer if they had ever received an email from IONOS asking to reset their password, which they denied (but I think something did happen there). Anyway, I asked the customer to request a new password from IONOS, share it with me, and then I’ll check what exactly went down. I’ll keep the community posted 😉

Ralf Koehnsen

And here’s the solution to the mystery: the client apparently had some kind of internal IT incident (whatever that looked like) and called in a friendly IT guy who started fiddling with every setting and password he could get his hands on in the IONOS backend. While he was at it, he also messed with the database, added himself—and the client—as SuperUsers, downgraded and disabled my SuperUser account, and changed the FTP password too. If you have clients like that, you don’t need hackers anymore.

Thanks for listening, everyone 😄

Cheers from the coast, Ralf

Reiner

Hi Ralf,
thanks for clearing that up.
Those IT guys sure keep things interesting. 😵

Cheers, Reiner