Category: Joomla

Updated 15 October 2026 · By Abhilash Sahoo, Founder, Infyways

Joomla security is the set of updates, account controls, server settings and monitoring that keep a Joomla website from being hacked, and that let you detect and clean an infection quickly if it happens.

To secure a Joomla website, keep Joomla core and every extension on a supported, patched version, turn on Multi-factor Authentication for all administrators, give users only the permissions they need, run a PHP version Joomla supports, block PHP execution in upload folders, and keep tested off-site backups.

Most Joomla sites are not hacked through Joomla core. They are hacked through an outdated extension, a weak administrator password or an unmaintained server. The checklist below covers all three.

In short: Joomla security is a maintenance routine, not a single extension. Patch first, lock down accounts second, harden the server third, and check regularly for signs of compromise.

Question	Short answer
Is Joomla secure?	Yes, when core and extensions are kept up to date
Latest safe Joomla versions	6.2.0, or 5.4.10 on Joomla 5 (both 13 October 2026)
Most common way in	Outdated third-party extensions and stolen admin passwords
Most important single step	Update core and extensions, then turn on MFA
Where malware hides	PHP and JavaScript files, templates, .htaccess, the images folder and the database
Site flagged by Google	Clean everything, then use Request Review in Search Console’s Security issues report
Hacked Joomla 3 site	Usually rebuild on Joomla 6 instead of cleaning file by file

Is Joomla secure?

Yes. Joomla core has a dedicated Joomla Security Strike Team (JSST) that publishes every fixed core vulnerability, with its CVE number and affected versions, in the Joomla Security Announcements, and ships fixes as numbered security releases. It also includes several protections in core that other CMSs often add with plugins:

• Access Control Lists (ACL): fine-grained permissions per user group (view, create, edit, publish, administer).
• A separate administrator application at /administrator, which you can restrict by IP address, VPN or HTTP authentication.
• Multi-factor Authentication in core since Joomla 4.2, including authenticator apps (TOTP), passkeys/WebAuthn, YubiKey and email codes.
• Automated core updates since Joomla 5.4, so a site can install new core releases without manual action.

The weak point is almost always what sits on top of core: third-party extensions, templates, hosting and people. The summer 2026 incidents below are a good example.

How do I secure a Joomla website? (12-step checklist)

Work through these steps in order. Steps 1–4 close the most common ways in.

1. Update Joomla core. Run the latest release of your branch: Joomla 6.2.0 (released 13 October 2026) or, if you are still on Joomla 5, 5.4.10 (13 October 2026, the last bugfix release for 5.x). Go to System > Update > Joomla. Plan your move to Joomla 6 with our Joomla 3 to 6 upgrade guide.
2. Update every extension and template. Go to System > Update > Extensions, click Find Updates, and update editors, page builders and form extensions first. They are the most common entry point.
3. Remove what you do not use. Uninstall (not just disable) unused extensions, old templates and sample data. Code that is not installed cannot be exploited.
4. Turn on Multi-factor Authentication. In Users > Manage, require MFA for every Super User and Administrator. Use an authenticator app or a passkey.
5. Apply least privilege. Keep very few Super Users. Editors and authors should never be in the Super Users group. Review Users > Groups and Global Configuration > Permissions.
6. Use strong, unique credentials. Unique passwords for Joomla admins, the database user, hosting control panel, FTP/SFTP and SSH. Prefer SFTP or SSH keys over plain FTP.
7. Run a supported PHP version. Joomla 6 needs PHP 8.3 or later (8.4 recommended); Joomla 5 needs PHP 8.1 or later. See our Joomla PHP settings guide.
8. Force HTTPS. Install a TLS certificate and set Global Configuration > Server > Force HTTPS to Entire Site.
9. Harden the web server. Rename htaccess.txt to .htaccess, block PHP execution in images, media, tmp and upload folders, and disable directory listing. Our Joomla .htaccess guide has the rules.
10. Protect the administrator area. Restrict /administrator by IP or VPN where your team allows it, or add HTTP authentication in front of it.
11. Turn off error display on live sites. Set Global Configuration > Server > Error Reporting to None (or System Default with display off) so paths and queries are not shown to visitors.
12. Back up and test restores. Keep automated, off-site backups of files and database, and restore one to staging at least once. See how to back up Joomla.

What are the most common Joomla security issues?

Threat	How it usually gets in	Warning signs	Fix
Vulnerable extension (RCE, file upload, SQL injection)	Outdated editor, page builder or form extension with a public endpoint	Unknown PHP files, new admin users, spam pages	Update or remove the extension, then check for a backdoor
Stolen or guessed admin password	Reused passwords, no MFA	Logins at odd hours, changed settings	Reset passwords, enforce MFA, review Super Users
Outdated Joomla core	Skipped security releases	Pre-update check warnings, public CVEs for your version	Update to the latest 6.x or 5.4.x release
Backdoor left after an old hack	Incomplete cleanup	Reinfection after “cleaning”	Full file comparison against clean core and extension packages
Malicious redirects / SEO spam	Injected code in templates, .htaccess or database	Visitors from Google sent to other sites, spam in search results	Clean files and database, request a review in Search Console
Weak hosting setup	Shared accounts, writable core files, old PHP	Other sites on the account also infected	Isolate the site, fix permissions, upgrade PHP

Where does malware hide in a Joomla site?

Attackers hide code where owners and scanners rarely look. Check all of these, not just PHP files:

Location	What to look for
JavaScript files (template, media, extension assets)	Appended code that writes an invisible <iframe> or loads a script from another domain
Template files (index.php, layout overrides in html/)	eval, base64_decode, long encoded strings, links you did not add
images, media, tmp, cache folders	Any .php, .phtml or .shtml file (these folders should hold media only)
.htaccess files	Extra redirects, auto_prepend_file lines, or an .htaccess file in every folder
Database: #__content, #__modules	<script> or <iframe> tags inside articles or Custom modules
Users table	Super Users or Administrators you did not create
Server cron jobs	Scheduled tasks that re-download malware after cleaning
Core files	Files that differ from a clean copy of the same Joomla version

How do I search a Joomla site for malware? (commands)

Run these over SSH from the Joomla root on a copy of the site where possible. A match is a lead, not proof; legitimate extensions sometimes use base64_decode.

# PHP obfuscation commonly used by malware
grep -rlE "eval\(|base64_decode\(|gzinflate\(|str_rot13\(" --include="*.php" .

# Hidden iframes or injected scripts in JavaScript files
grep -rliE "<iframe|document\.write\(|String\.fromCharCode" --include="*.js" .

# PHP files where only media should be
find images media tmp cache -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.shtml" \)

# Files changed in the last 7 days
find . -type f -mtime -7 -not -path "./cache/*" -not -path "./administrator/cache/*"

# Count .htaccess files (a normal site has very few)
find . -name ".htaccess" | wc -l

# Cron jobs for the hosting user
crontab -l

In the database (replace jos_ with your table prefix):

SELECT id, title FROM jos_content WHERE introtext LIKE '%<iframe%' OR `fulltext` LIKE '%<iframe%' OR introtext LIKE '%<script%';
SELECT id, title FROM jos_modules WHERE content LIKE '%<iframe%' OR content LIKE '%<script%';

Also check Users > Manage for unknown Super Users. In the summer 2026 SP Page Builder attacks, JoomShaper reported attacker accounts with @secure.local email addresses.

From our cleanup work: two real cases

Case 1: Google flagged the site, but every scan came back clean

A client’s site was flagged by Google as dangerous. Before contacting us, the client had scanned the PHP files and run one of the most popular Joomla security and firewall extensions. Neither found anything.

We found the cause in a JavaScript file. Code added to it created an invisible iframe that loaded content from another site. Because the file was JavaScript, not PHP, the PHP scan and the extension’s checks did not flag it. After removing the injected code and checking the other .js files, templates and database for similar iframes and scripts, we requested a review in Google Search Console.

Lesson: PHP-only scans and security extensions can miss JavaScript and asset injections. Check .js files, templates and the database for hidden iframes and scripts, then request a review in the Security issues report.

Case 2: An .htaccess file in every folder

A server was hacked and the attacker had created an .htaccess file in every folder. The site was running Joomla 3 on PHP 7.2, both long out of support. Instead of cleaning it file by file, we upgraded it to Joomla 6. We kept only the database content and the images and media, checked them first, and rebuilt everything else from clean sources. We then fixed the remaining issues on the new, supported version.

Lesson: on an outdated, heavily compromised site, a clean rebuild plus upgrade is more reliable than trying to find every infected file. See our Joomla upgrade service and the Joomla 3 to 6 upgrade guide.

What should I do if Google says “This site may be harmful”?

Google shows warning labels in search results, and browsers can show a red warning page, when it detects hacked content, malware or deceptive pages. To remove the warning, follow Google’s process in the Security issues report help page:

1. Open Security issues in Google Search Console and expand each issue to see sample affected URLs. The list is only a sample.
2. Inspect pages safely with the URL Inspection tool or curl, because hacked pages can show different content to Google and to logged-in owners.
3. Clean the issue across the whole site, not just the sample pages, and fix every issue listed.
4. Close the hole that let the attacker in (update, remove the vulnerable extension, rotate passwords).
5. Select Request Review and describe what you found and fixed. Google says reviews can take from a few days to a few weeks.

How do I prevent reinfection?

• Find and fix the entry point before you clean, or the attacker will return.
• Replace core and extension files with fresh copies from official packages instead of editing infected files.
• Remove unknown users and rotate every password: Joomla admins, database, hosting, FTP/SFTP and SSH.
• Delete malicious cron jobs and extra .htaccess files.
• Update everything, then apply the hardening configs below.
• Keep monitoring: file-change alerts, Search Console email alerts and regular backups.

For the full recovery process, follow our guide to repair a hacked Joomla website.

Copy-paste Joomla security configs

Test these on staging first. They assume Apache 2.4 (the Require syntax) and a standard Joomla install.

1. Block PHP execution in upload folders. Save as .htaccess inside images, media and tmp:

<FilesMatch "\.(php|php[0-9]|phtml|phar|shtml)$">
    Require all denied
</FilesMatch>

2. In the root .htaccess: disable directory listing and block direct access to configuration.php:

Options -Indexes

<Files "configuration.php">
    Require all denied
</Files>

3. File permissions: directories 755, files 644, and configuration.php read-only:

find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chmod 444 configuration.php

Joomla needs to write configuration.php when you save Global Configuration, so set it back to 644 temporarily when you change settings.

4. Security headers. Joomla 4 and later include the System – HTTP Headers plugin, where you can set these without editing server files. Or add them in .htaccess:

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Strict-Transport-Security "max-age=31536000"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

Only add Strict-Transport-Security once the whole site works over HTTPS, and test a Content-Security-Policy separately, because a strict one can break editors and page builders.

What are the current Joomla security vulnerabilities? (October 2026)

Safe versions to run now (checked 15 October 2026)

• Joomla core: 6.2.0, or 5.4.10 if you are still on Joomla 5. The most recent core security fixes shipped in 6.1.4 and 5.4.9 (fixed 25 September 2026), including an MFA bypass through “remember me” cookies (CVE-2026-92227), SSRF vectors (CVE-2026-92222) and arbitrary directory deletion via cache purge (CVE-2026-90915). The release before that, 6.1.3 and 5.4.8, blocked SHTML uploads (CVE-2026-73373) and fixed another MFA bypass (CVE-2026-73337). Details are in the Joomla Security Announcements.
• JCE editor: CVE-2026-48907 (CVSS 10.0) let unauthenticated visitors upload and run PHP through editor profiles. It was fixed in 2.9.99.5 with extra hardening in 2.9.99.6. Run the current release: JCE 2.9.99.12, or JCE 3.0.2 on Joomla 5/6 (both released 7 October 2026). Older sites that cannot update can use the vendor’s free security patch.
• SP Page Builder: 6.8.0 (12 August 2026) fixed CVE-2026-67285, an unauthenticated PHP file-inclusion flaw (CVSS 9.2) affecting versions up to 6.7.1, and CVE-2026-65876, an unauthenticated SQL injection. JoomShaper also warns that versions 5.x to 6.6.0 could have been infected through an upload hole. Run 6.8.0 or later, then check for planted admin accounts and backdoor files.

If either extension was outdated on a live site during summer 2026, assume compromise until you have checked, using the malware checks above.

Is Joomla more secure than WordPress?

Joomla gives you more security controls in core: granular ACL, a separate administrator application and built-in MFA. WordPress can reach the same level, but usually with more plugins, and each plugin adds attack surface. WordPress is also attacked far more often, mainly because it runs far more websites, so automated bots target it first.

In practice, the platform matters less than maintenance. A patched WordPress site is safer than an abandoned Joomla site, and the other way round. Joomla’s advantage is that you need fewer third-party extensions to reach a strong baseline.

Do I need a Joomla security extension?

Not to be secure, but one can help. As our first case shows, it can also miss malware. A firewall or security extension can add login protection, file-change detection and blocking rules. It cannot replace updates, MFA, least-privilege accounts, server hardening and backups, and it cannot fix a site that already has a backdoor. Install one as an extra layer after the checklist, not instead of it.

Get help with Joomla security

If your site is already hacked, start with cleanup, then hardening. Infyways handles hacked Joomla site recovery, security hardening and Joomla 5/6 upgrades on a staging copy first, and replies within 12 hours. See our Joomla support and maintenance plans or our Joomla upgrade service.

Frequently asked questions

How do I secure my Joomla website?

Update Joomla core and all extensions, remove unused extensions, enable Multi-factor Authentication for administrators, limit Super Users, run PHP 8.3+ for Joomla 6, force HTTPS, block PHP execution in upload folders, restrict the administrator area and keep tested off-site backups.

Is Joomla secure in 2026?

Yes, when it is maintained. Joomla core has a Security Strike Team and regular security releases. Most hacked Joomla sites were running an outdated extension or core version, not a flaw in current Joomla.

Which Joomla version is the most secure?

The latest release of a supported branch. As of 15 October 2026 that is Joomla 6.2.0, or 5.4.10 for sites still on Joomla 5. Joomla 3 and Joomla 4 no longer receive security updates.

How do I know if my Joomla site is hacked?

Look for unknown administrator accounts, PHP files in image or media folders, changed core files or .htaccess, spam pages in Google, unexpected redirects and security warnings in Google Search Console.

Does Joomla have two-factor authentication?

Yes. Joomla 4.2 and later include Multi-factor Authentication in core, with authenticator apps, passkeys/WebAuthn, YubiKey and email codes.

Do I need a security extension for Joomla?

No, but it can add an extra layer. It does not replace updates, MFA, server hardening and backups.

Is Joomla more secure than WordPress?

Joomla includes more security controls in core, such as granular ACL and a separate administrator application, and it is targeted less often. Both are secure only when core, extensions and hosting are kept up to date.

Why didn’t my security extension detect the malware?

Many scanners focus on PHP files and known signatures. Malware injected into JavaScript files, templates or database content, such as a hidden iframe, can pass those checks. Search .js files, templates and the #__content and #__modules tables as well.

Should I clean a hacked Joomla 3 site or rebuild it?

Usually rebuild. Joomla 3 no longer receives security updates, so cleaning leaves you on vulnerable software. Keep the checked database content and media, rebuild the rest on Joomla 6 from clean sources, and update the extensions.

What should I do first if my Joomla site is hacked?

Take the site offline or restrict access, make a backup for evidence, then clean files and database, remove unknown users, rotate all passwords, update everything and harden the site. Follow our guide to repair a hacked Joomla website.

If you’ve tried integrating MailerLite with Joomla, you already know the problem.

There’s no solid, dedicated module.

Most people end up doing one of these:

• Using embed forms from MailerLite
• Writing custom API code
• Installing outdated or unsupported extensions

None of these feel right.

Embeds look out of place.
Custom code takes time.
And exposing API keys in the browser is risky.

So I built a proper solution.

👉 https://joomlax.com/mailerlite-newsletter.html

A clean, secure, AJAX-based MailerLite newsletter module for Joomla.

The Problem with Existing MailerLite Integrations

Let’s be honest.

Most integrations are not built for real Joomla workflows.

Here’s what usually goes wrong:

• API keys exposed in frontend scripts
• No control over design
• Poor mobile layout
• No proper module positioning
• Hard to maintain across Joomla updates

If you’re running Joomla 4, 5, or planning for 6, this becomes a bigger issue.

You need something native.

Something that works the Joomla way.

---

The Solution: MailerLite Newsletter Module (AJAX-Based)

This module is built specifically for Joomla.

No hacks. No workarounds.

Just install, configure, and publish.

👉 Live Demo: https://demo.joomlax.com/demo/utilities/mailerlite-newsletter
👉 Documentation: https://joomlax.com/documentation/mailerlite-newsletter

---

Why This Module Is Different

1. Your API Key Stays Secure

Most solutions expose your API key in JavaScript.

This one doesn’t.

Everything runs server-side using Joomla’s AJAX system.

• No API key in browser
• No leaks in DevTools
• Clean and secure integration

Your credentials stay where they belong.

On your server.

---

2. Works Like a Native Joomla Module

This is not a plugin hack.

It behaves exactly like a Joomla module:

• Assign to any module position
• Show on selected menu items
• Create multiple instances

Just like you expect.

---

3. Fully Customizable Design

You control everything.

• Heading and intro text
• Button label and icons
• Success and error messages
• Colors, spacing, typography

Horizontal or vertical layout.

It adapts to your design. Not the other way around.

---

4. Built for Modern Joomla (4, 5 & 6)

No legacy code.

No compatibility issues.

This module is designed for current and future Joomla versions.

So you don’t have to worry about migrations later.

---

5. Multilingual Ready

Running a multilingual site?

No problem.

• Create separate modules per language
• Translate content easily
• Use Joomla language files

Works perfectly with standard Joomla workflows.

---

MailerLite Forms vs This Joomla Module

At first glance, you might think:

“MailerLite already gives me a form. Why do I need this?”

Fair question.

Let’s break it down.

MailerLite Embedded Forms

MailerLite’s default forms are:

• JavaScript-based
• Submitted without page reload (AJAX-like)
• Easy to copy and paste

Sounds good.

But here’s where things fall short:

• Runs entirely in the browser
• Limited control over layout inside Joomla
• Styling can clash with your template
• Harder to manage across multiple module positions

It works.

But it doesn’t feel native to Joomla.

---

This Module (Server-Side AJAX Approach)

This module takes a different approach.

• AJAX on the frontend
• Processing handled on the server via Joomla
• API token never exposed
• Full control over design and placement

So you get:

• Better security
• Cleaner integration
• More flexibility

And most importantly…

It behaves like a real Joomla module.

---

Quick Comparison

MailerLite Embed:

• Frontend-driven
• Limited customization
• Not Joomla-native

This Module:

• Server-side secure processing
• Fully customizable
• Built for Joomla workflows

---

The Bottom Line

MailerLite forms are fine for quick setups.

But if you’re building a serious Joomla website…

You need something more controlled.
More secure.
And easier to manage.

That’s exactly what this module delivers.

---

How to Install and Set It Up

This is where things get simple.

Step 1: Download the Module

Go here:
👉 https://joomlax.com/mailerlite-newsletter.html#download

Download the ZIP file.

---

Step 2: Install in Joomla

• Go to System → Install → Extensions
• Upload the ZIP file
• Wait for success message

Done.

---

Step 3: Create the Module

• Go to System → Manage → Site Modules
• Click New
• Select MailerLite Newsletter

Now assign:

• Module position
• Menu items

---

Step 4: Connect MailerLite

You’ll need two things.

API Token:

• Go to MailerLite dashboard
• Navigate to Integrations → Developer API
• Copy your API token

Group ID:

• Go to Subscribers → Groups
• Open your group
• Copy the numeric ID

Paste both into the module settings.

That’s it.

---

Step 5: Customize the Form

Now make it yours.

• Add heading and description
• Set placeholders
• Update button text
• Style colors and layout

Preview it.

Adjust it.

Publish it.

---

What Happens After Setup

Once live:

• Visitors enter name and email
• Form submits via AJAX
• Data is sent securely to MailerLite
• Subscriber is added to your group

No page reload.

No messy redirects.

Just smooth user experience.

---

Who Is This For

This module is perfect if you:

• Use Joomla and MailerLite
• Want a clean newsletter signup
• Care about security
• Don’t want to write custom code
• Build websites for clients

It’s especially useful for agencies standardizing their workflow.

---

Why I Built This

I couldn’t find a proper solution.

Every project needed the same thing.

A simple and secure MailerLite integration for Joomla.

So instead of repeating the same workaround again and again…

I turned it into a reusable module.

---

Try It Yourself

👉 Product Page: https://joomlax.com/mailerlite-newsletter.html
👉 Demo: https://demo.joomlax.com/demo/utilities/mailerlite-newsletter
👉 Documentation: https://joomlax.com/documentation/mailerlite-newsletter
👉 MailerLite Newsletter Joomla Extensions Directory – https://extensions.joomla.org/extension/login-popup-pro/

---

Final Thoughts

MailerLite is powerful.

Joomla is powerful.

But without the right bridge, things get messy.

This module fixes that.

Simple setup.
Secure integration.
Clean design.

That’s how it should have been from the start.

Related Joomla guides

• add a module inside an article
• Joomla module not showing
• free Joomla module generator

Need hands-on help? See our Joomla module development.

If you upgraded from Joomla 3, you’ve probably run into this issue.

Your login popup stopped working.

No warning.
No support.
No clear replacement.

And suddenly, your website’s login experience is broken.

Let’s fix that.

What Happened to Login Popup by ExtStore?

The popular extension Login Popup by ExtStore was widely used across Joomla 3 websites.

It helped you:

• Show login forms in a popup
• Improve user experience
• Avoid redirecting users to a separate login page

But now, it’s no longer available.

The listing on the Joomla Extensions Directory has been unpublished.

Reason: PE1 error and no ongoing support.

Most importantly, it does not support Joomla 4, 5, or 6.

Why This Became a Big Problem

When users migrated to newer Joomla versions, things broke.

Here’s what started happening:

• Login popup stopped appearing
• JavaScript errors showed up
• CSS conflicts with templates
• Some sites even displayed blank pages

And there was no proper alternative that behaved the same way.

The Real Reason It Broke

This is not just about compatibility.

Joomla 4 and above introduced major changes:

• Namespaced PHP
• Modern APIs
• New extension architecture
• Different asset handling

Old extensions built for Joomla 3 cannot work without a full rewrite.

That’s exactly what happened here.

My Experience Fixing This

I’ve migrated multiple Joomla websites using this plugin.

Every time, the same issue came up.

Clients wanted the same popup login experience.

But no extension could match it properly.

So instead of trying to patch outdated code, I rebuilt it from scratch.

Introducing Login Popup Pro

Here’s the solution:

Login Popup Pro

This is not just an update.

It’s a complete rewrite built specifically for Joomla 4, 5, and 6.

And it keeps everything users loved about the original plugin.

Try the Live Demo

See it in action:

https://demo.joomlax.com/demo/popup-and-iframes/login-popup-pro

What Makes Login Popup Pro Better?

Built for Modern Joomla

No hacks or legacy code.

It uses:

• CMSPlugin architecture
• Factory, LayoutHelper, HTMLHelper
• Namespaced structure

This makes it faster, cleaner, and more stable.

Clean Asset Structure

No more dependency issues.

All assets are properly organized:

• CSS
• JavaScript
• Images

Everything is loaded cleanly without conflicts.

Full Appearance Control

No need for custom CSS.

You can control:

• Colors
• Shadows
• Border radius
• Popup width
• Overlay styling

All through simple settings.

Improved User Experience

Small features that make a big difference:

• Auto-open with URL hash like #login or #logout
• ESC key to close popup
• Click outside to close
• Flexible placement for registration links

Scoped and Conflict-Free Code

Everything is properly namespaced:

• CSS classes use jx-lp-*
• JavaScript uses Jx.LoginPopup
• Language keys are isolated

This avoids conflicts with templates and other extensions.

Proper Documentation

Everything is clearly documented.

You get:

• Structured feature files
• Detailed documentation
• Easy setup instructions

Documentation link: https://joomlax.com/documentation/login-popup-pro

Important Links

Product Page
https://joomlax.com/login-popup-pro.html

Download
https://joomlax.com/login-popup-pro.html#download

Documentation
https://joomlax.com/documentation/login-popup-pro

Demo
https://demo.joomlax.com/demo/popup-and-iframes/login-popup-pro

Why Not Use Other Alternatives?

You might find a few plugins out there.

But most of them:

• Don’t match the original behavior
• Have limited customization
• Break in newer Joomla versions
• Are not actively maintained

This solution was built specifically for real migration issues.

Who Should Use This?

This is for you if:

• You upgraded from Joomla 3
• You used ExtStore Login Popup
• You want the same experience back
• You want more flexibility and control

Final Thoughts

Extensions may stop working.

But your website doesn’t have to.

If your login popup broke after upgrading Joomla, you now have a proper fix.

A modern, stable, and feature-rich replacement built for today’s Joomla.

The Problem: Static Website with No CMS

A client had a clean, fast static website.

Everything looked good.

But there was one missing piece.

They needed a blog.

Not just a simple page. A proper system where they could:

• Log in securely
• Add new articles
• Manage categories
• Update content anytime

Building a CMS from scratch would take time.

And honestly, it didn’t make sense.

So I looked for a smarter approach.

The Idea: Use Joomla as a Headless CMS

Instead of building something new, I used Joomla as the backend.

No frontend.

No templates.

Just content management.

Then I connected it to Next.js.

This gave me:

• A ready-to-use admin panel
• Secure authentication
• API access to content
• A fast frontend

The result was simple and powerful.

Final Architecture

Here’s what I built:

• Main website → clientsite.com using Next.js
• Blog section → /blog (dynamic)
• Joomla backend → joomla.clientsite.com

Joomla handles:

• Content creation
• Content storage
• API responses

Next.js handles:

• UI
• Routing
• Rendering

This separation makes everything cleaner.

Step 1: Install Joomla 6 on a Subdomain

Create a subdomain like:

• joomla.clientsite.com
• or api.clientsite.com

Install a clean Joomla 6 setup.

Then simplify it:

• Disable frontend modules
• Ignore templates
• Use it only for managing content

Think of it as a backend dashboard, not a website.

Step 2: Enable Joomla Web Services API

Joomla 4+ comes with built-in Web Services.

Go to Plugins and enable:

• Web Services – Content
• API Authentication

Once enabled, your API is live.

Example endpoint:

https://joomla.clientsite.com/api/index.php/v1/content/articles

Step 3: Generate Authentication Token

Joomla supports token-based authentication.

Steps:

• Go to Users
• Open your user profile
• Generate API token

Now every API request can be secured.

Example header:

Authorization: Bearer YOUR_API_TOKEN

Step 4: Fetch Articles from Joomla API

Use the API to fetch content.

Example request:

GET https://joomla.clientsite.com/api/index.php/v1/content/articles

The response includes:

• Title
• Slug
• Content
• Categories
• Metadata

Everything needed to render a blog.

Step 5: Connect Next.js 16 (App Router)

In Next.js, I used App Router with native fetch.

Here’s a simple example:

export async function getArticles() {
  const res = await fetch(
    "https://joomla.clientsite.com/api/index.php/v1/content/articles",
    {
      headers: {
        Authorization: "Bearer YOUR_API_TOKEN",
      },
      cache: "no-store",
    }
  );

  if (!res.ok) {
    throw new Error("Failed to fetch articles");
  }

  return res.json();
}

This pulls data directly from Joomla.

Step 6: Render Blog Page

Now create your blog listing page:

export default async function BlogPage() {
  const data = await getArticles();

  return (
    <div>
      {data.data.map((article) => (
        <div key={article.id}>
          <h2>{article.attributes.title}</h2>
        </div>
      ))}
    </div>
  );
}

Clean and simple.

Step 7: Create Dynamic Blog Pages

Use slugs from Joomla.

export async function generateStaticParams() {
  const data = await getArticles();

  return data.data.map((article) => ({
    slug: article.attributes.alias,
  }));
}

Now each article becomes:

/blog/my-article-slug

Fully dynamic.

Important: Avoid Duplicate Content

This step is critical.

Your Joomla backend is public.

So the same content exists in two places:

• Joomla URLs
• Next.js blog pages

This creates duplicate content.

Fix it:

Go to Joomla Global Configuration and set:

• Robots → noindex

This ensures only your Next.js site gets indexed.

Why I Didn’t Use WordPress

You might ask:

Why not use WordPress?

It has an API:

/wp-json/wp/v2/posts

And yes, it works.

But here’s the reality.

How WordPress Works in Headless Mode

By default:

• API is public
• No authentication required
• Anyone can access your content

Example:

https://example.com/wp-json/wp/v2/posts

You get everything instantly.

The Limitations

Authentication is not strict by default

To secure it, you need:

• Application passwords
• JWT plugins
• OAuth setups

This adds complexity.

Plugin dependency

For real projects, you often need:

• ACF for custom fields
• Authentication plugins
• API extensions

More plugins means:

• More maintenance
• More risks

Less control over API behavior

Customizing APIs requires:

• Hooks
• Filters
• Custom coding

It’s flexible, but not clean.

Larger attack surface

Because of its popularity:

• More bots target it
• Plugin vulnerabilities are common
• APIs are often exposed

Why Joomla Worked Better

With Joomla, things were straightforward.

• API is structured
• Authentication is built-in
• No extra plugins needed
• Better control over access

It gave me:

• A secure backend
• Clean API integration
• Less maintenance

Performance Benefits

This setup is fast.

Because:

• Main site is static
• Blog is dynamic only where needed
• API calls are lightweight

This improves:

• Load speed
• SEO
• User experience

Pros of Using Joomla as Headless CMS

• No need to build CMS
• Secure admin panel
• Built-in API
• Easy for clients
• Works well with modern frameworks
• Scalable

Cons You Should Know

• Requires initial setup understanding
• API is less beginner-friendly
• Token handling required
• Joomla UI may feel heavy for small tasks

When You Should Use This Approach

Use it when:

• You have a static site
• You need dynamic blog content
• You want a secure backend
• You want to save development time

Avoid it when:

• You need full CMS-driven frontend
• You want everything in one system

Final Thoughts

This setup worked perfectly.

The client got:

• A fast website
• A simple backend
• Full control over content

And I avoided building a CMS from scratch.

Sometimes the smartest solution is not building more.

It’s choosing better tools.

If you’re working with Next.js and need a CMS, give Joomla headless a try.

Related Joomla guides

• Joomla GraphQL support
• Joomla custom fields

Need hands-on help? See our headless Joomla development.

If you are running a Joomla website today, one thing is certain. Your images are slowing you down.

Heavy JPEGs and PNGs increase your load time. Slow websites lose rankings and customers. In a competitive CMS ecosystem, performance decides who stays visible.

Modern image formats like WebP and AVIF are essential for achieving speed, better conversions, and stronger SEO.

AVIF is now emerging as the best performing image format available for the open web. It is significantly smaller, cleaner, and sharper than anything websites have used before.

After checking Joomla extension listings, community guides, optimization tutorials, GitHub discussions, and developer blogs across the internet, it is clear that there are barely any AVIF converters made specifically for Joomla. This makes the WebP Converter by JoomlaX one of the first Joomla extensions to offer AVIF conversion in a stable, production-ready format.

This is a major advantage for any Joomla website owner who wants to get ahead of competitors.

In this guide, you will see why AVIF matters, how it compares to WebP, what the JoomlaX WebP Converter offers, and why it is trusted by more than 1000 users worldwide.

Why AVIF Matters for Joomla Websites

Most developers know WebP. It has become a standard across the web.

AVIF, however, is the next step forward. It offers even better compression using the AV1 codec developed by Google, Amazon, Microsoft, Meta, and Netflix.

Independent Joomla optimization tutorials confirm the following points.

AVIF provides significantly better compression than WebP.
AVIF produces cleaner details and less noise at smaller sizes.
Joomla itself only recently started working toward deeper AVIF support.
There are almost no Joomla-specific AVIF converter extensions in the market.

This creates a clear advantage for early adopters.

If your site loads faster, Google rewards you. Your images look better. Your bandwidth drops. Your conversions improve.

WebP vs AVIF: Which Format Should Joomla Websites Choose

Below is a simple comparison designed for clarity and quick decision making.

Feature	WebP	AVIF
Compression Size	Very good	Excellent and often 20 to 50 percent smaller
Image Quality	High	Higher at smaller file sizes
Transparency Support	Yes	Yes
Animation Support	Yes	Yes
Browser Support	Very strong	Improving rapidly
Best For	Blogs, shops, general sites	High traffic and SEO focused websites
Joomla Compatibility	Widely supported	Supported fully by this extension

Both formats matter. WebP is stable and mature. AVIF is the future. With this extension, you get both automatically.

Introducing the WebP and AVIF Converter for Joomla

The WebP Converter by JoomlaX is an advanced image optimization extension designed to convert your entire media library to WebP and AVIF formats using fast server-side processing.

It works perfectly with Joomla 4, Joomla 5, and Joomla 6.

It has been trusted by more than 1000 users across the world for improving performance, SEO, and loading speed.

Key Features

• Converts JPG, PNG, GIF, and BMP to WebP and AVIF
• Lossless and lossy quality options
• Smart directory scanning
• Automatic conversion for all future uploads
• Bulk conversion for existing images
• Automatic fallbacks for unsupported browsers
• Enterprise level performance
• Lightweight and optimized codebase
• Compatible with all templates and page builders
• Works with shared hosting, VPS and cloud servers
• Full logging and monitoring
• Zero downtime activation

Why This Extension Stands Out

One of the first AVIF converters for Joomla

After extensive online research, it is clear that there are almost no AVIF converters developed specifically for Joomla. Most extensions focus only on WebP. General conversion tools do not integrate with Joomla’s media structure or template output.

This plugin fills that gap and places your Joomla website ahead of competitors.

Trusted by more than 1000 users worldwide

The plugin powers websites across eCommerce, corporate, agency, portfolio and news platforms. Joomla site owners trust it for stability, speed improvements and ease of use.

Supports Joomla 4, Joomla 5 and Joomla 6

Very few image optimization extensions are ready for Joomla 6. This one is fully compatible and tested.

Measurable SEO improvements

Once images are converted, PageSpeed Insights scores increase instantly. You can expect improvements in:

• Largest Contentful Paint
• First Contentful Paint
• Total page weight
• Mobile speed
• Bounce rate
• Search engine rankings

Pricing Plans

These pricing tiers are currently available.

• 19 USD: Starter
• 29 USD: Personal
• 49 USD: Business
• 99 USD: Developer (unlimited domains)

Every plan includes:

• One year of free updates
• One year of premium support
• Instant download
• Seven day refund window

Official Links

Product Page
https://joomlax.com/webp-converter.html

Joomla Extensions Directory (JED) Listing
https://extensions.joomla.org/extension/webp-converter/

Purchase Page
https://joomlax.com

How to Use the AVIF and WebP Converter

Step 1

Install the extension from the Joomla Extension Manager and enable it.

Step 2

Choose your target formats. Select WebP, AVIF or both.

Step 3

Select your image directories. This includes /images, banners, product folders and any custom paths.

Step 4

Run the converter. Your entire media library is processed using optimized server-side code.

Step 5

Review your converted images. Fallbacks ensure compatibility for older browsers.

The setup takes only a few minutes.

Who Should Use This Extension

• Corporate websites
• Blogging websites
• Joomla eCommerce stores
• High traffic portals
• Photography portfolios
• Agency websites
• News and media sites
• Any website that wants better SEO and faster load times

If your business depends on performance, you should be using AVIF.

Frequently Asked Questions

Do I need technical skills

No. The interface is simple and beginner friendly.

Will this break my template

No. Fallback options prevent compatibility issues.

Does it support Joomla 4, 5 and 6

Yes. All listed versions are fully supported.

Will AVIF reduce image quality

AVIF improves image quality at significantly smaller sizes.

Does it work with page builders

Yes. It works with SP Page Builder, YOOtheme, Helix, Gantry and all major Joomla builders.

Why You Should Switch to AVIF Today

Websites are getting heavier. Users expect instant load times. Search engines are increasingly strict.

AVIF gives you sharper images at much smaller file sizes. Your Joomla site becomes faster, more efficient and more competitive. When you combine AVIF with WebP inside a single automated extension designed for Joomla, the performance advantage becomes significant.

Final Call to Action

If you want higher SEO rankings, faster load times and better user experience, this is the most effective upgrade you can make today.

Download the WebP and AVIF Converter for Joomla
https://joomlax.com/webp-converter.html

View it on the Joomla Extensions Directory
https://extensions.joomla.org/extension/webp-converter/

Join more than 1000 users already improving their Joomla site speed.
Start today and experience the difference.

Joomla is a free, open source content management system that started on 17 August 2005 when the core developers of Mambo left that project and forked its code. The name comes from the Swahili word jumla, meaning “all together” or “as a whole”. It is owned by a non-profit, Open Source Matters, Inc., built by volunteers, and as of Joomla 6.1.2 it ships as 9,916 files, 76 database tables, 248 core extensions, 89 Composer packages, and 13,409 English language strings. Those last five numbers were counted from the official release package, not copied from another article.

Most “Joomla facts” posts repeat the same ten lines: born from a rebellion, Swahili name, volunteers, big brands use it, good security record. Several of those lines are wrong or unverifiable. This article keeps the facts that check out, corrects the ones that do not, and adds a set of numbers nobody else has published: what is actually inside the Joomla 3.10.12 and Joomla 6.1.2 release archives, measured file by file. Where a fact comes from Joomla’s own code or a primary source, the source is linked.

What you will learn

• The real dates behind the Mambo fork, the name, and the first release
• What the Swahili codenames mean and where the copyright line points
• Joomla 3.10.12 versus Joomla 6.1.2 by the numbers: files, PHP lines, tables, extensions, strings, packages
• Which database drivers Joomla really ships, and why “Joomla supports MS SQL” needs a date
• How many languages come “out of the box” (the 70+ claim is wrong)
• What the security statistics do and do not say
• Where Joomla stands in 2026 market share, and why half of the Joomla web is still on version 3

How these facts were checked

Historical facts are linked to Joomla’s own announcements, Open Source Matters, or the Joomla issue tracker. Technical facts were measured on 24 September 2026 by unpacking the official Joomla_6.1.2-Stable-Full_Package.zip and Joomla_3.10.12-Stable-Full_Package.zip from the joomla-cms GitHub releases and running a small Node script over the folders. “Core PHP” means every .php file outside libraries/vendor and media/vendor. “Vendor” means those two folders. Market share figures are from W3Techs, August 2026. Nothing below is an estimate unless it says so.

Facts 1 to 6: origin and name

1. Joomla began as a walkout, and the fork happened on 17 August 2005

Joomla did not start from a blank editor. The core developers of the Mambo CMS published an open letter on 17 August 2005 announcing they were leaving because of a dispute over the governance of the Mambo Foundation set up by Miro International. They forked the Mambo 4.5.2.3 code and formed a non-profit, Open Source Matters, Inc., to hold the project’s assets. More than a thousand people registered on the new opensourcematters.org site within a day. The letter and the timeline are still archived on joomla.org.

2. The name was announced two weeks later, and the first release was a renamed Mambo

The project had no name for two weeks. “Joomla!” (with the exclamation mark, which is part of the official name) was announced on 1 September 2005. Joomla 1.0.0 followed on 22 September 2005. That first release was Mambo 4.5.2.3 with the branding changed and a handful of bug fixes, which is why every early Joomla tutorial still worked on Mambo and vice versa. Real divergence began with Joomla 1.5 in January 2008, which introduced the framework layer and the first API break.

3. “Joomla” is Swahili, and so are the release codenames

Joomla is an English spelling of the Swahili word jumla, “all together” or “as a whole”. The convention did not stop with the product name. Every release carries a Swahili codename in libraries/src/Version.php: Joomla 3.10.12 is Daraja (bridge, because 3.10 was the bridge to Joomla 4), Joomla 5.4 is Kutegemea (to rely on), Joomla 6.0 is Kuimarisha (to strengthen), and Joomla 6.1 is Nyota (star). The codename is a real constant in the code, so you can read it from your own install:

// libraries/src/Version.php in Joomla 6.1.2
const MAJOR_VERSION = 6;
const MINOR_VERSION = 1;
const PATCH_VERSION = 2;
const DEV_STATUS = 'Stable';
const CODENAME = 'Nyota';
const RELDATE = '7-July-2026';

4. The logo was chosen by community vote; the name was not

A popular version of the story says the name Joomla was picked by a public poll. The core team chose the name and announced it. What the community did vote on was the logo: a design competition ran in September 2005 and the winning entry, the four interlocking figures, became the mark that is still in use. If you want a “democratic from day one” fact, the logo is the accurate one.

5. Every core file still carries the same copyright line from 2005

Open index.php in Joomla 3.10.12 or Joomla 6.1.2 and the header reads @copyright (C) 2005 Open Source Matters, Inc. The copyright is held by the non-profit, not by any company or individual, and the code is licensed under the GNU GPL version 2 or later. That ownership structure is why no vendor can take Joomla closed source, which was the exact fear that caused the Mambo fork.

6. Joomla turned 20 on 17 August 2025 and is still shipping on a six-month cycle

The project marked its twentieth anniversary in August 2025. Two months later, on 14 October 2025, Joomla 6.0 and Joomla 5.4 were released on the same day, following the Joomla 4 and 5 pattern where the last minor of one branch and the first of the next share a release date so that upgrades are a one-hop change. Joomla 6.1 arrived on 14 April 2026 and 6.1.2 on 7 July 2026, according to the RELDATE constant in the package. Details are in the official release announcements. If you are still on 3 or 4, our Joomla upgrade issues guide covers the only safe hop order.

Facts 7 to 14: Joomla by the numbers (3.10.12 versus 6.1.2)

These figures are measured from the two official release archives. They are the kind of numbers that appear in no other Joomla facts article because they require downloading the packages and counting.

Measured in the release package	Joomla 3.10.12	Joomla 6.1.2	Change
Files in the archive	6,468	9,916	+53%
Unpacked size	35.8 MB	87.5 MB	+144%
Core PHP files	2,749	3,159	+15%
Core PHP lines	505,449	473,721	-6%
Vendor PHP files (libraries/vendor)	363	2,742	7.5x
Composer packages	34	89	+55
Joomla Framework packages (joomla/*)	16	22	+6
Database tables created on install	78	76	-2
Core extensions registered on install	184	248	+64
Core plugins	94 in 17 groups	156 in 24 groups	+62
English (en-GB) language strings	11,662 in 410 files	13,409 in 538 files	+15%
Installer languages in the package	77	59	-18
Front-end vendor libraries	jQuery and Bootstrap 2 in media/jui	28 libraries in media/vendor	rebuilt
Pre-compressed .gz assets	0	447	new
Minimum PHP	5.3.10	8.3.0	13 years of PHP

7. Joomla 6 has fewer lines of core PHP than Joomla 3

The surprise in the table: core PHP shrank from 505,449 lines to 473,721 while the package more than doubled in size. The reason is that Joomla stopped carrying its own copies of things. Joomla 3 had 363 vendor PHP files; Joomla 6 has 2,742, pulled in through 89 Composer packages including Symfony Console 7.4, the PHP-TUF client, WebAuthn libraries for passkeys, and 22 packages from Joomla’s own framework. Growth moved from the core into dependencies, which is the opposite of the “bloated CMS” story.

8. Joomla is also a PHP framework, and 22 pieces of it are in every install

The Joomla Framework is a set of standalone PHP packages you can use without the CMS. In Joomla 6.1.2, 22 of them ship inside libraries/vendor/joomla: application, archive, authentication, console, crypt, data, database, di, event, filesystem, filter, http, input, language, oauth1, oauth2, registry, router, session, string, uri, and utilities. Joomla 3.10.12 shipped 16. The CMS is, in a very literal sense, built on top of the framework it publishes.

9. Joomla ships seven database drivers but installs on two

“Joomla supports MySQL, PostgreSQL and MS SQL” is true only with a date attached. Joomla 3.10.12 contains ten driver files (MySQL, MySQLi, PDO, PDO MySQL, PostgreSQL, pgsql, Oracle, SQLite, SQL Server, SQL Azure) and installer SQL for three database families: mysql, postgresql, and sqlazure. Joomla 6.1.2’s database package still has Mysql, Mysqli, Pdo, Pgsql, Sqlazure, Sqlite and Sqlsrv driver folders, but the installer only carries SQL for mysql and postgresql. Microsoft SQL Server support left the installer with Joomla 4. So: MySQL or MariaDB and PostgreSQL are supported; anything else is a driver without an install path. Current requirements are in the Joomla technical requirements.

10. A default install has 9 user groups and 5 access levels, and that has not changed since Joomla 1.6

Joomla’s access control is often called its hidden strength. The default shape is small and stable: both 3.10.12 and 6.1.2 seed 9 user groups (Public, Guest, Registered, Author, Editor, Publisher, Manager, Administrator, Super Users) and 5 access levels (Public, Guest, Registered, Special, Super Users). What makes it powerful is not the defaults but the fact that every component, category, and item stores its permissions in the #__assets table as a nested set, so a rule set on a category cascades to every article below it. That table exists in both versions.

11. The installer speaks 59 languages; the site speaks one until you add packs

The common claim is that Joomla supports “70+ languages out of the box”. Measured: the 3.10.12 package includes 77 installer language folders and the 6.1.2 package includes 59, from af-ZA to zh-TW. The installed site, in both versions, contains exactly one language: en-GB. British English is Joomla’s source language; en-US is itself a translation pack. Extra languages are installed from System, Install, Languages in the administrator, and the core multilingual system (language filter plugin, per-language menus and associations) has been in the core since Joomla 1.6 in 2011. So multilingual is native; the languages themselves are downloads.

12. Joomla 6 pre-compresses 447 assets

The 6.1.2 archive contains 447 .gz files alongside the CSS and JavaScript in media/. They are pre-gzipped copies that a correctly configured web server can send without compressing on each request. Joomla 3 shipped none. If your host’s server is configured for static gzip, Joomla 6 is doing part of the performance work for you; see our guide to Gzip compression in Joomla for the setting that matters.

13. Joomla’s system JavaScript is 7.6 KB

media/system/js/core.min.js, the file every Joomla 6 page loads, is 7.6 KB minified. The full Cassiopeia stylesheet, with Bootstrap 5 compiled into it, is 247 KB. Joomla 3’s Protostar template CSS was 160 KB plus 95 KB of jQuery and 28 KB of Bootstrap 2 JavaScript. Joomla 6 still ships jQuery in media/vendor for extensions that need it, but the core front end no longer depends on it.

14. Joomla 6 updates itself, and signs the update

Joomla 6.0 introduced automatic core updates for patch releases, backed by The Update Framework (TUF). The 6.1.2 package includes the php-tuf/php-tuf client and creates a #__tuf_metadata table on install to store the signed metadata that proves an update package really came from the project. Other tables that only exist in the modern branch tell the same story of what was added since Joomla 3: #__workflows (publishing workflows, 4.0, with a drag-and-drop editor in 6.1), #__scheduler_tasks (built-in cron, 4.1), #__webauthn_credentials (passkey login), #__user_mfa (multi-factor authentication), #__guidedtours, #__schemaorg, and #__mail_templates.

Facts 15 to 20: people, security, and the web

15. Nobody is paid to write Joomla

Joomla has no parent company. Open Source Matters is a New York non-profit, the Production department is volunteer-led, and the release announcements name the contributors. The Joomla 6.0 announcement credited more than 34 contributors and 208 merged pull requests for that release alone. Contributors are tracked on the Joomla Volunteers Portal. Compare that with the WordPress, Drupal, and Typo3 ecosystems, where a company or foundation with paid staff sits at the centre.

16. Pizza, Bugs and Fun is a real event with a real name

Contributors gather for coordinated bug-fixing days called Pizza, Bugs and Fun (PBF). They run as local meetups and online sprints coordinated through the Volunteers Portal, and the results show up as bursts of merged pull requests in the joomla-cms repository. It is the closest thing Joomla has to a hackathon culture, and it has run for well over a decade.

17. The security statistics say less than the headlines

The often quoted line is that Joomla made up under 2 percent of infected sites in Sucuri’s 2022 Hacked Website Report while WordPress made up 96.2 percent. Those numbers are real, but they track the share of cleaned sites by platform, which follows market share, not the safety of the code. The more useful facts: Joomla publishes every core vulnerability with a CVE and a fix version on the Joomla Security Centre, and Joomla 3.10 reached end of life on 17 August 2023, so the 53 percent of Joomla sites still on version 3 (next fact) have had no security fixes for three years. That, not the market share ratio, is the number that decides whether a Joomla site is safe.

18. More than half of the Joomla web is still on Joomla 3

W3Techs, August 2026: Joomla powers 1.7 percent of websites whose CMS is known and about 1.2 percent of all websites, which puts it fifth or sixth among content management systems depending on the month. Within Joomla, 53.1 percent of detected installs are still on version 3, more than three years after its end of life. That is the single most important Joomla fact for anyone who owns one, and it is why Joomla 3 to 6 migration is still the busiest Joomla service line in 2026.

19. Joomla has been downloaded well over 100 million times

The project reported 22 million downloads by 2010 and passed 100 million during the Joomla 3 lifecycle. Because the project publishes downloads from its own CDN and GitHub, the exact figure is tracked on downloads.joomla.org. Independent counts put the total above 120 million by 2021. Treat any figure more precise than “over 100 million” as an estimate.

20. The Joomla Extensions Directory is curated by volunteers, and every listing is reviewed

The Joomla Extensions Directory (JED) is not an open marketplace. Submissions are reviewed by the volunteer JED team against a published checklist before they are listed, and listings must declare their licence and Joomla version compatibility. Free and commercial extensions sit in the same directory, which is why a JED listing with recent reviews is the quickest compatibility check before you install anything on Joomla 6.

Facts that do not check out

Claim you will read elsewhere	What checks out
“The name Joomla was chosen by a community poll”	The core team announced the name on 1 September 2005. The logo was the community vote.
“Joomla supports 70+ languages out of the box”	6.1.2 ships 59 installer languages and one site language (en-GB). Packs are installed afterwards.
“Joomla supports Microsoft SQL Server”	Only Joomla 3 installed on SQL Server/SQL Azure. Joomla 4, 5 and 6 install on MySQL/MariaDB and PostgreSQL.
“Joomla is under 2% of hacked sites, so it is more secure”	Sucuri’s share tracks market share. Over half of Joomla sites run an end-of-life version, which is the actual risk.
“Joomla is bloated compared to Joomla 3”	Core PHP lines fell 6% from 3.10.12 to 6.1.2. The package grew because dependencies moved into Composer packages.
Lists of brands “running on Joomla”	Most such lists date from 2010 to 2015 and are not re-verified. Check a site’s current CMS with a detector before repeating it.

What thinner articles leave out

Topic	Typical post	This article
Fork story	“Born from a rebellion in 2005”	Dated: letter 17 Aug, name 1 Sept, release 22 Sept 2005, forked from Mambo 4.5.2.3
Codenames	Not mentioned	Swahili codenames read from Version.php, with meanings
Size of the CMS	Adjectives	Files, bytes, PHP lines, tables, extensions, strings, packages for 3.10.12 and 6.1.2
Databases	“Supports MySQL, PostgreSQL, MS SQL”	Drivers shipped versus installer SQL shipped, per version
Languages	“70+ out of the box”	59 installer languages, 1 site language, packs installed later
Security	Sucuri percentage	What the percentage measures, EOL date for Joomla 3, share of sites still on it
Market share	Old figure or none	W3Techs August 2026 with the Joomla 3 share
Wrong facts	Repeated	Listed and corrected in a table

Key takeaways

1. Joomla forked from Mambo on 17 August 2005, got its name on 1 September, and released 1.0 on 22 September. The copyright has belonged to the non-profit Open Source Matters ever since.
2. The name is Swahili for “all together”, and every release codename is Swahili too; Joomla 6.1 is Nyota, star.
3. Joomla 6.1.2 is 9,916 files, 76 tables, 248 core extensions, 156 plugins, 89 Composer packages and 13,409 English strings, measured from the official package.
4. Core PHP got smaller between Joomla 3 and 6 (505k to 474k lines). Dependencies got bigger (363 to 2,742 vendor PHP files).
5. Only MySQL/MariaDB and PostgreSQL have an install path in Joomla 4, 5 and 6. SQL Server support ended with Joomla 3.
6. The installer speaks 59 languages; the site speaks en-GB until you install packs.
7. 53 percent of Joomla sites are still on the end-of-life Joomla 3. That is the fact that matters if you own one.

Frequently asked questions

When was Joomla created?

The fork from Mambo was announced on 17 August 2005, the name Joomla! on 1 September 2005, and Joomla 1.0.0 was released on 22 September 2005.

What does Joomla mean?

It is an English spelling of the Swahili word jumla, meaning “all together” or “as a whole”. Release codenames such as Daraja, Kutegemea, Kuimarisha and Nyota are Swahili as well.

Who owns Joomla?

Open Source Matters, Inc., a non-profit formed in 2005 to hold the project’s copyright and trademarks. The code is GPL v2 or later and is written by volunteers.

How many files and tables does Joomla have?

Joomla 6.1.2 unpacks to 9,916 files (87.5 MB) and creates 76 database tables. Joomla 3.10.12 was 6,468 files (35.8 MB) and 78 tables. These were counted from the official release archives.

Is Joomla a framework as well as a CMS?

Yes. The Joomla Framework is published as standalone PHP packages, and 22 of them ship inside every Joomla 6.1.2 install under libraries/vendor/joomla.

Which databases does Joomla support?

Joomla 4, 5 and 6 install on MySQL or MariaDB and on PostgreSQL. Joomla 3 also installed on Microsoft SQL Server and SQL Azure. Driver files for SQLite and SQL Server still exist in the Joomla 6 database package but have no installer SQL.

How many languages does Joomla support?

The Joomla 6.1.2 installer includes 59 languages. The installed site includes only en-GB; other languages are installed as packs from the administrator. Multilingual site features have been in the core since Joomla 1.6.

Is Joomla more secure than WordPress?

Not by the statistic usually quoted. Sucuri’s share of infected sites tracks market share. Joomla’s real security problem is that about 53 percent of its sites run Joomla 3, which has had no security fixes since 17 August 2023.

How popular is Joomla in 2026?

W3Techs (August 2026) measures Joomla at 1.7 percent of websites with a known CMS and about 1.2 percent of all websites, fifth or sixth among CMSs.

What is new in Joomla 6?

Automatic, TUF-signed core updates, PHP 8.3 as the minimum, passkey and multi-factor login, a drag-and-drop workflow editor in 6.1, and a core that dropped 441 legacy class aliases into an optional Behaviour – Backward Compatibility 6 plugin. See Joomla upgrade issues for what breaks when you move.

Who can help move a Joomla 3 site to Joomla 6?

Infyways has upgraded and migrated Joomla sites for more than a decade. Joomla upgrades start at $149, and a free audit of your site is returned within 12 hours.

Released on Monday, 06 January 2025, Joomla 5.2.3 is here, and it’s not just another routine update. Packed with critical security fixes and essential bug resolutions, this release underscores why staying updated is non-negotiable in today’s digital landscape. Whether you’re a seasoned developer or someone managing their own site, this is an upgrade you don’t want to skip.

Let’s break down what’s new, what’s fixed, and why this update matters.

Why This Update is a Big Deal

Cyber threats are evolving daily, and CMS platforms like Joomla are prime targets. The Joomla! Project has been proactive in addressing vulnerabilities, and 5.2.3 is no exception. With critical security patches, including fixes for cross-site scripting (XSS) vulnerabilities and access control flaws, this release fortifies your site against potential breaches.

But it’s not just about security. Bug fixes in this version ensure smoother performance, better compatibility, and an overall enhanced user experience.

What’s New: A Quick Rundown of Joomla 5.2.3

Here’s what you’re getting with this update:

Security Fixes You Need to Know About

1. XSS in Module Chromes
   • Vulnerabilities in module chromes allowed attackers to inject malicious scripts. Fixed.
2. XSS in Menu List IDs
   • A flaw in menu list IDs was patched to prevent unauthorized script injection.
3. Access Control Violations
   • Core views had read permission flaws, potentially exposing sensitive data. These are now resolved.

Why it matters: Cross-site scripting attacks are among the most common threats, and these fixes significantly reduce your site’s risk.

Bug Fixes and Enhancements

This update isn’t just about plugging security holes. It also brings several improvements to make Joomla more robust and user-friendly:

Area	Fix/Improvement
TinyMCE Plugin	Fixed validation issues in the joomlaExtButtons plugin.
Email Handling	Apostrophes in email addresses? No longer a problem.
Modules	Removed redundant empty images and anchors in mod_articles_news and mod_articles_category.
PHP Compatibility	Fixed deprecation warnings for smoother performance on PHP 8.x.
Frontend UI	Cancel links on the add verification code page now display the correct styles.

These changes make Joomla smoother, faster, and better equipped to handle modern web demands.

Why You Should Upgrade Now

Delaying updates can leave your site vulnerable to attacks or performance issues. Here’s why you should prioritize upgrading to Joomla 5.2.3:

1. Enhanced Security
   • Protect your site against known vulnerabilities like XSS and ACL violations.
2. Improved Performance
   • Benefit from resolved bugs and enhanced compatibility, particularly with PHP 8.x.
3. Future-Proofing
   • Stay aligned with Joomla’s development roadmap and avoid complications when future updates roll out.

Pro Tip: Always back up your site before updating. Use tools like Akeeba Backup to ensure you’re protected in case something goes wrong.

How to Update to Joomla 5.2.3

Updating Joomla is straightforward, but it’s always good to follow best practices:

1. Backup Your Site
   • Save a copy of your database and files using a backup extension.
2. Check Compatibility
   • Verify that your extensions and templates are compatible with Joomla 5.2.3.
3. Apply the Update
   • Go to Components > Joomla Update, check for updates, and click Install Update.

If you encounter issues, Joomla’s official documentation provides step-by-step guidance.

Pro Tip: Always upgrade your Joomla website to the latest version to ensure maximum security and optimal performance.

Final Thoughts: Don’t Wait to Secure Your Site

Joomla 5.2.3 is more than just an update; it’s a shield against modern security threats and a step toward smoother, faster website management. If you value your site’s security, performance, and future-proofing, upgrading isn’t optional—it’s essential.

Take the leap today and ensure your Joomla site is running at its best. Because when it comes to the web, staying secure is staying smart.

Building a website? Great! But here’s where things get tricky: picking the right Content Management System (CMS) for the job. A CMS isn’t just software—it’s the backbone of your site. Get it right, and managing your content becomes a breeze. Get it wrong, and, well… good luck with the headaches.

With so many CMS platforms out there—each promising to be the best—it’s easy to feel overwhelmed. Don’t worry, though. Let’s break it down step by step and clear up all your doubts.

First Things First: What Is a CMS, Anyway?

A CMS is basically the tool you use to build, manage, and update your website. Think of it like a digital toolkit that helps you:

• Create new pages and posts.
• Organize content like blogs, images, or videos.
• Keep everything updated without touching a single line of code (well, most of the time).

Why Should I Use a CMS?

If you’ve never used a CMS before, you might wonder why it’s so important. Can’t you just code everything manually or use a simple website builder? Sure, you could—but here’s why a CMS is often the smarter choice:

1. Easy Content Management

A CMS lets you create, update, and organize content effortlessly—even if you don’t know how to code. From writing blog posts to adding new pages, it’s all point-and-click.

2. Saves Time and Resources

Building and maintaining a website manually takes a lot of time, especially for updates. A CMS automates much of this, letting your team focus on more important tasks.

3. Collaboration Made Simple

With a CMS, multiple team members can work on the same site at the same time. Features like user roles and permissions ensure everyone has access to just what they need.

4. Keeps Your Site Updated

Modern CMS platforms are constantly updated with new features, security patches, and compatibility improvements. This ensures your site stays fresh and secure.

5. Built-In SEO Tools

Most CMS platforms come with tools to optimize your site for search engines, helping you rank higher and drive more traffic.

6. Scalable for Growth

Whether you’re a small business or planning to grow big, a CMS can scale with your needs. Add new features, handle more traffic, and expand your content—all without starting from scratch.

7. Integrations Galore

From social media to email marketing and analytics, CMS platforms often support plugins or integrations that make connecting your site with other tools a breeze.

8. Cost-Effective in the Long Run

While there’s an upfront cost, using a CMS reduces the long-term expenses of hiring developers for every little change or update.

In short, a CMS empowers you to focus on your content and goals, not the technicalities of managing a website.

SaaS vs. On-Premise vs. Cloud-Hosted CMS: What’s the Difference?

Before diving into specific features, you need to decide what type of CMS you need. Here’s a comparison to help you understand the differences:

Type	How It Works	Examples	Pros	Cons
SaaS CMS	No installation or maintenance. You pay a monthly fee, and the provider handles technical stuff.	Core DNA, Wix, CrownPeak	Hassle-free, always up-to-date, no technical expertise needed.	Limited control and customization.
On-Premise CMS	Install on your own server or hosting provider. Full control over the system.	WordPress, Drupal	Complete control over customization and data.	Requires maintenance, updates, and hosting.
Cloud-Hosted CMS	Purchase software, but host it on third-party servers.	WP Engine, Hostway	Scalable, reliable, and less technical work compared to on-premise solutions.	Costs can grow with site size and traffic.

Features to Look for in a CMS

Not all CMS platforms are created equal. Before making a choice, consider what features your business needs—both now and in the future.

1. Ease of Use

Can your team create, edit, and publish content without needing technical skills?

2. Design Flexibility

Does the CMS allow for custom designs, or are you limited to predefined templates?

3. Mobile Responsiveness

Your site must look good on mobile—this is non-negotiable.

4. SEO Tools

Built-in SEO features are essential to get your site ranked on search engines.

5. Third-Party Integrations

Check for plugins or integrations for email marketing, analytics, and social media sharing.

6. Security

Ensure the CMS can protect your content and user data from threats.

7. Scalability

The platform should grow with your business and handle increasing traffic without issues.

8. Workflow Management

Does it simplify publishing workflows and approvals for teams?

9. Customization

Look for the ability to tweak the platform as your needs change.

10. Analytics

Built-in analytics tools are a big plus for tracking performance and making improvements.

Common Mistakes to Avoid When Choosing a CMS

Not every CMS is going to work for you, no matter how good it looks on paper. Here are some common traps to watch out for:

Going for the Cheapest Option

Saving money upfront can cost you in frustration and limitations down the line.

Ignoring Scalability

Your website will (hopefully) grow. Make sure your CMS can handle it.

Overlooking Maintenance Needs

Who’s going to manage updates, backups, and security? You or the CMS provider?

Skipping Stakeholder Input

Don’t make the decision alone. Talk to your marketing, IT, and sales teams to understand their needs.

Final Thoughts: How to Make the Right Choice

Choosing the right CMS is about more than just features—it’s about finding the right fit for your business. Think about:

• Your current needs (content creation, updates).
• Your team’s skill level (do you need something beginner-friendly?).
• Your long-term goals (can the CMS grow with you?).

There’s no one-size-fits-all answer, but by asking the right questions and thinking strategically, you’ll land on the CMS that’s just right for your business.

Still unsure? Need help figuring it all out? Request a quote today, and we’ll guide you through the process to find the perfect CMS for your needs.