# Security on OJS and how to manage hackers **URL:** \ **Category:** Infrastructure, Interoperability, Collaboration\ **Tags:** ojs, cyber-attack\ **Created:** [18 December 2025 18:54 UTC](https://forum.edch.eu/t/security-on-ojs-and-how-to-manage-hackers/697 "2025-12-18T18:54:07Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![martamorgado](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.edch.eu/martamorgado/32/258_2.png) [@martamorgado](https://forum.edch.eu/u/martamorgado)\ **Post date:** [18 December 2025 18:54 UTC](https://forum.edch.eu/t/security-on-ojs-and-how-to-manage-hackers/697/1 "2025-12-18T18:54:07Z")
Hello everyone. I would like to know if anyone has any tips on how to improve security in OJS and the publishing system, such as how to combat cyber attacks and hackers. Does anyone have any tips or useful resources? Thank you in advance for your attention and help! ---
**Author:** ![Mark](https://avatars.discourse-cdn.com/v4/letter/m/e9c0ed/32.png) [@Mark](https://forum.edch.eu/u/Mark)\ **Post date:** [23 December 2025 10:49 UTC](https://forum.edch.eu/t/security-on-ojs-and-how-to-manage-hackers/697/2 "2025-12-23T10:49:57Z")
The most obvious thing to do is to keep your version as up to date as possible. Updates fix bugs as well as keep everything running smoothly and securely. This brief memo on the PKP website covers the main things: > **[Memo: Keeping your OJS Installation Secure - Public Knowledge Project](https://pkp.sfu.ca/2025/10/15/keep-your-ojs-installation-secure-with-updates/)** > > Is it time for you to update your Open Journal Systems (OJS) installation? Find out in this post from PKP. ---
**Author:** ![marc](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.edch.eu/marc/32/104_2.png) [@marc](https://forum.edch.eu/u/marc)\ **Post date:** [26 December 2025 11:44 UTC](https://forum.edch.eu/t/security-on-ojs-and-how-to-manage-hackers/697/3 "2025-12-26T11:44:29Z")
A key point to put on the table is that an updated OJS is a secure OJS. In practice, many updates that only change the last version number include security fixes, even if they sometimes go unnoticed. Staying up to date—even with these “minor patches”—makes a real difference. If we review this year’s incidents, the pattern is quite clear: reported security issues almost always occur in installations running outdated or outright forgotten versions. We’re not talking about active flaws in maintained versions, but rather vulnerabilities that had already been fixed yet remained present because the system had not been updated. I don’t intend to blame anyone—I’m very aware that many installations aren’t better maintained because editorial services lack IT staff, and institutional IT services are often overloaded. But I do want to advocate for PKP: all software (think Windows or Android) requires periodic updates, and it’s our responsibility to stay current. That said—and while not essential for most cases—I’ll try to answer your question by outlining some strategies I’m applying or planning for 2026, aimed at hardening OJS installations (because I’m a bit paranoid): - Use Docker: Docker enables fast, non-traumatic updates. Docker images are released within 24–48 hours after an official release, and since containers isolate each journal, a problem in one instance won’t spread to others. - Integrate software for 2FA: Sometimes problems arise from poor user management policies. Open-source tools exist that add an extra layer of security to access (e.g., Keycloak). - Regular audits: Tools exist that perform automated security audits. Some are open-source and can be integrated into your infrastructure. Sometimes, you can also request audits from your institution’s IT services. - Install CrowdSec: an alternative, collaborative tool to fail2ban. In any case, all of this represents an additional, almost “paranoid” level of security. For a normal scenario, keeping OJS updated is more than sufficient—and by far the most important measure. Best regards, m. ---
**Author:** ![martamorgado](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.edch.eu/martamorgado/32/258_2.png) [@martamorgado](https://forum.edch.eu/u/martamorgado)\ **Post date:** [5 January 2026 09:12 UTC](https://forum.edch.eu/t/security-on-ojs-and-how-to-manage-hackers/697/4 "2026-01-05T09:12:18Z")
Thank you so much! We keep up with the updates at PUB IN and UMinho Editora. ---
**Author:** ![martamorgado](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.edch.eu/martamorgado/32/258_2.png) [@martamorgado](https://forum.edch.eu/u/martamorgado)\ **Post date:** [5 January 2026 09:14 UTC](https://forum.edch.eu/t/security-on-ojs-and-how-to-manage-hackers/697/5 "2026-01-05T09:14:25Z")
Thank you so much! This is very helpful and detailed. ---
**Author:** ![ajnyga](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@ajnyga](https://forum.edch.eu/u/ajnyga)\ **Post date:** [8 January 2026 13:18 UTC](https://forum.edch.eu/t/security-on-ojs-and-how-to-manage-hackers/697/6 "2026-01-08T13:18:57Z")
Hi, The most important things are said already above. Just want to highlight that probably the single most common reason for hacked OJS installations is that the installation is not done correctly when selecting the location of the files folder. This is the folder where OJS stores the article full text files among other things. What you see sometimes is people placing the files folder to a location where it is directly accessible ie. inside the public\_html folder. This opens an easy access for hackers while they can upload malicious files and then access them. I do not have statistics but I would say that at least 50% of all hack reports in the PKP forum are related to this. The installation instructions of course explain the [proper location of the folder.](https://docs.pkp.sfu.ca/admin-guide/en/deploy#secure-files-directory) ---
**Author:** ![martamorgado](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.edch.eu/martamorgado/32/258_2.png) [@martamorgado](https://forum.edch.eu/u/martamorgado)\ **Post date:** [8 January 2026 14:03 UTC](https://forum.edch.eu/t/security-on-ojs-and-how-to-manage-hackers/697/7 "2026-01-08T14:03:47Z")
Thank you so much for the input, very helpful! ---
**Author:** ![mpaulhac](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.edch.eu/mpaulhac/32/48_2.png) [@mpaulhac](https://forum.edch.eu/u/mpaulhac)\ **Post date:** [20 February 2026 09:45 UTC](https://forum.edch.eu/t/security-on-ojs-and-how-to-manage-hackers/697/8 "2026-02-20T09:45:04Z")
Hi Marta, @milica.sevkusic posted the updated EIFL OJS Checklist in another topic (it might be of interest to you!). There’s a section on OJS security, and this discussion you started actually made it into the latest version! Nice impact 😎 > [@Updated EIFL Checklist: Good practices in using Open Journal Systems software for journal editing and publishing](https://forum.edch.eu/t/updated-eifl-checklist-good-practices-in-using-open-journal-systems-software-for-journal-editing-and-publishing/779): > > We have updated the [EIFL checklist of good practices in using the free and open source software, Open Journal Systems (OJS)](https://www.eifl.net/resources/eifl-checklist-good-practices-using-open-journal-systems-software-journal-editing-and), for managing the entire researcher-to-reader workflow for submission, peer review and production of scholarly journals. This is the fourth version of the checklist. It includes an overview of the latest release of OJS 3 (OJS 3.5.0-3 released on 19 December 2025) and tips on software plugins, journal procedures and policies, system security and content preservation, usage … ---
**Author:** ![martamorgado](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.edch.eu/martamorgado/32/258_2.png) [@martamorgado](https://forum.edch.eu/u/martamorgado)\ **Post date:** [20 February 2026 10:51 UTC](https://forum.edch.eu/t/security-on-ojs-and-how-to-manage-hackers/697/9 "2026-02-20T10:51:13Z")
Thank you so much! I saw it yesterday on Linkedin, I didn’t have time to check yet. Thank you for remembering me, that’s really kind of you. ---
**Author:** ![marc](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.edch.eu/marc/32/104_2.png) [@marc](https://forum.edch.eu/u/marc)\ **Post date:** [20 February 2026 13:43 UTC](https://forum.edch.eu/t/security-on-ojs-and-how-to-manage-hackers/697/10 "2026-02-20T13:43:23Z")
Big fan of Milica and Iryna’s work on this document, so I’m really pleased to see the update. Inspired (in part) by their work, at CRAFT-OA we created another, more extensive document that aims to cover the entire process of creating an editorial service (from idea to implementation), including security tips (pp. 60–61). As we explain in the introduction: “Presented in a structured format, the Toolkit is designed for flexible use: it can be read end-to-end or consulted as a reference to address specific needs at any stage of a service’s evolution.” We call this document [DO.ASK](https://handbook.diamas.org/mod/book/view.php?id=121), and for now it only exists in the version delivered to the commission, which, let’s say, has a rather unfriendly layout… but the idea over the coming months is to give it a bit more attention and distribute it properly, as, due to the rush of the project’s closure, it was published almost “behind the scenes” and went largely unnoticed. 😃 ---
**Author:** ![irynakuchma](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.edch.eu/irynakuchma/32/334_2.png) [@irynakuchma](https://forum.edch.eu/u/irynakuchma)\ **Post date:** [20 February 2026 16:52 UTC](https://forum.edch.eu/t/security-on-ojs-and-how-to-manage-hackers/697/11 "2026-02-20T16:52:48Z")
And we are your big fans Marc, thank you! Milica is looking into your document now to see how we could reference and reuse some parts of it in other topic-related resources. Have a great weekend! ---
**Author:** ![marc](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.edch.eu/marc/32/104_2.png) [@marc](https://forum.edch.eu/u/marc)\ **Post date:** [20 February 2026 18:21 UTC](https://forum.edch.eu/t/security-on-ojs-and-how-to-manage-hackers/697/12 "2026-02-20T18:21:36Z")
Iryna, why would I blush? 😊😊😊 The admiration is mutual, but I can’t keep the praise to myself—the DO.ASK is a collective effort, involving many hours and many people… and as someone once said, “built upon the shoulders of giants,” like the EIFL checklist, which is truly wonderful. Let’s talk whenever you like to see how we can fit everything into the EDCH framework. Thank you for your work! “Omnia sunt communia” 😉