A Joomla template override is not working when Joomla never loads the PHP file you edited. The usual causes are the wrong html/ folder, a template style that is not the one assigned to the page, a filename of _default.php (a sublayout, not the layout), an alternative layout selected on the menu item or module, plugin HTML that does not live in the component override, or cache still serving the old markup. This is a file that never loaded. If the file used to work and vanished after an update, that is a different article: template override disappeared after an update.
Create Overrides is the safe copy for components and modules. Plugin tmpl is usually copied by hand into html/plg_…. Official map: Layout Overrides in Joomla. User-manual walkthrough: Template Overrides. Put the copy on a child template, not in parent Cassiopeia.
The layout Joomla looks for is default.php. A leading underscore is a sublayout. The assigned template style must be the folder that contains the file.
What you will learn
How to prove the override file is the one PHP included
Why Create Overrides for com_ and mod_ is safer than a hand-made path
Why plugin HTML is usually html/plg_…, not the article default.php
Why _default.php never replaces default.php
What an alternative layout on the menu item actually selects
Why cache and the wrong template style look like a “dead” override
What you see
Likely cause
Wrong rabbit hole
Stock markup, your PHP comment missing
Wrong folder, wrong template style, or _default.php
Editing components/
Override works on Home, not on a landing page
That menu item uses another template style
Recreating the override
Article body changed, Prev/Next did not
Page navigation is a plugin layout
More com_content PHP
Blog looks stock, single article changed
You overrode article/default.php. The blog uses articles/… (or blog.php)
Cache only
File on disk, still stock
Alternative layout selected, or cache
Reinstalling the component
Child looks stock
Override still sits in parent html/
“Overrides are broken”
Step 1: Prove which template is assigned, then prove the file is included
Overrides are files on a template. They are not a Global Configuration switch.
Open the public URL that should use the override.
System → Site Template Styles. Note the default (star).
Open that menu item. Template Style may be a different style (child vs parent, or a club template).
If the page uses cassiopeia_brand and you edited templates/cassiopeia/html/…, Joomla will not load your copy. Child html/ wins for that style. Parent Cassiopeia html/ is unused when the child is assigned. The reverse is also true: assign the parent, and the child’s override is ignored.
Prove inclusion:
On the file you believe is active, add a unique class on a wrapper you already have, for example js-override-probe. Do not use a core-edit in components/.
System → Maintenance → Clear Cache. Test logged out if Page Cache is on.
View Source. Search for js-override-probe.
If the class is missing, Joomla did not include that file. Keep going. If the class is present and the page still “looks stock,” you changed the wrong markup, or CSS is hiding it: Joomla CSS changes not showing.
Step 2: Use Create Overrides for components and modules
Hand-built folders are how silent misses happen.
System → Templates → Site Templates → open the active template (the child).
Open Create Overrides.
Pick the component view (com_content → article, category, …) or the module (mod_login, mod_menu, …).
Joomla copies into templates/{template}/html/com_… or html/mod_….
JLayouts (Read more, images, fields chrome) are not always the view default.php. They live under html/layouts/… after you override them from the Layouts list. If you changed article/default.php and the intro image is still stock, you needed html/layouts/joomla/content/…. The user manual shows the LayoutHelper::render mapping: Template Overrides.
Step 3: Name the file default.php, not _default.php
The layout file is default.php. A leading underscore marks a sublayout. Joomla will not use _default.php as the main view.
Create Overrides copies default.php. Some views also copy default_logout.php, blog_item.php, and similar. Those extra files are included from the main layout ($this->loadTemplate('item') looks for {layout}_item.php). They do not replace default.php.
If you renamed the copy to _default.php because a blog said “underscore means override,” you hid the file from the layout resolver. Rename it back to default.php.
If you only edited blog_item.php while the menu item still uses the default layout (not blog), that sublayout is never included. Match the layout name Joomla is actually rendering (next step).
Step 4: Check Alternative Layout on the menu item, module, or article
Joomla can select a file that is not default.php.
On the menu item: Options (or the Blog / Article tab) → Layout / Alternative Layout. Values such as blog, a template-specific layout, or a custom mylayout.php mean your default.php override is idle for that view.
On a module: Advanced → Alternative Layout. A module can use default.php on one instance and a custom layout on another. You overrode the file the instance is not using.
On an article: some views let the article pick a layout. If that is set, it wins for that article.
Fix:
Set Alternative Layout back to default (or inherited), or
Create or copy the override with the same basename as the selected layout (blog.php, mylayout.php), still without a leading underscore.
A custom alternative layout is a second file in html/com_…/. It is not a child-template feature by itself. The child only decides which template’s html/ is searched.
Step 5: If the HTML comes from a plugin, do not expect a component override
Content plugins inject markup after (or beside) the component layout. Prev/Next, vote, some field types, and many extra buttons are plugintmpl files.
Overriding html/com_content/article/default.php will not restyle page navigation. You need html/plg_content_pagenavigation/default.php (and a plugin that actually calls getLayoutPath). Create Overrides usually does not list plugins. You copy tmpl by hand.
If the string is only a label, use a language override instead of PHP.
Step 6: Clear cache, then decide if the file was never going to survive an update
After a path fix:
Clear Cache (and Page Cache for guests).
Hard refresh.
Search View Source for your probe class again.
If the override used to appear and the PHP file is gone from disk after a Joomla or template update, stop this article. You edited the parent. Read template override disappeared after an update.
If the file is still there and still unused, you are still on folder, style, filename, alternative layout, or plugin output.
Folder path, then the assigned style, then default.php versus a sublayout, then Alternative Layout, then plugin HTML. Cache last.
Key takeaways
An override that “does nothing” did not load. Prove it with a probe class in View Source after Clear Cache.
Create Overrides for com_ and mod_ on the active child. Hand-typed folders fail silently.
Plugin output is html/plg_{group}_{element}/, usually manual. Guide: plugin override.
The main file is default.php. _default.php is a sublayout. blog_item.php does not replace blog.php.
Alternative Layout on the menu item or module selects a different basename. Override that file, or set layout back to default.
Child html/ wins only when that child’s style is assigned. Parent and child are not a merge of every PHP file.
JLayouts live under html/layouts/, not always in the view default.php.
A file that vanished from disk after an update is not this diagnosis. Use the disappeared checklist.
Frequently asked questions
Why is my Joomla template override not working?
Joomla is not including that PHP file. The folder does not match the view, the assigned template style is a different template, the file is named _default.php, Alternative Layout points at another basename, or the HTML comes from a plugin. Prove it with a probe class in View Source.
Should the override file be named _default.php?
No. Name it default.php (or blog.php if that is the layout in use). A leading underscore is a sublayout. Create Overrides already uses the correct names.
Why did Create Overrides copy default.php and default_logout.php?
default_logout.php is a sublayout of the login module’s default layout. Edit the file that prints the markup you care about. Deleting default.php when you only wanted logout is correct if you do not want to override the login form. The user manual does exactly that: Template Overrides.
Can I override a plugin from the article layout?
No. Plugin HTML that uses tmpl is overridden under html/plg_…. See Joomla plugin override.
Does a child template automatically use the parent html folder?
No. Same-named files in the child win. Files you never copied stay on the parent. An override that exists only on the parent is unused while the child style is assigned.
I updated Joomla and the override vanished. Is that this article?
When a Joomla template override is not working, stop editing components/ and stop renaming files with a leading underscore. Assign the child style, put default.php (or the alternative layout’s real name) in the matching html/com_ or html/mod_ folder, and treat plugin markup as html/plg_. A probe class in View Source tells you in one reload whether PHP included the file. If the file used to exist and the disk is stock after an update, switch to the disappeared guide and move the work into a child.
Joomla JavaScript is not working when the browser never executes the file you think you added, or it executes and throws before your code runs. Open the console first. Then confirm user.js is requested from media/templates/site/{template}/js/user.js on the active template (a child does not load the parent’s user.js). Typical failures after that are $ is not defined (jQuery is not on the page), an ES module in a classic deferred script, script order, Content-Security-Policy, or another extension overwriting the same global.
user.js on the parent, old templates/…/js/ path, or user.js.js
Rewriting the script
$ is not defined / jQuery is not defined
Cassiopeia does not load jQuery unless an extension called it
Copy-pasting a Joomla 3 snippet
Cannot use import statement outside a module
ES import inside Cassiopeia’s classic user.js (deferred, not type="module")
More defer
Script in Network 200, nothing happens
Error earlier in the same file, wrong selector, or you tested a page that does not include the node
Cache only
Console CSP Refused to execute
HTTP Headers plugin or server Content-Security-Policy
Disabling SEF
Works in admin, fails on the site
Site template user.js vs Atum. Two templates, two files
“Joomla JS is broken”
Works logged in, fails as guest
Page Cache serving HTML without your new <script>, or a guest-only extension
Access on a module
Step 1: Read the browser console before you add another file
Do not stack a second snippet on top of a SyntaxError.
Open the public page that should run the script. Use a private window so extensions and your admin session are not in the way.
DevTools → Console. Reload.
DevTools → Network → filter JS. Reload again.
Write down, in this order:
The first red error (file name and line). Later errors are often fallout.
Whether user.js (or the extension file you care about) appears, and its HTTP status.
Whether the URL is /media/templates/site/{active-template}/js/user.js.
A 404 is a path problem (Step 2). A 200 plus a TypeError is a runtime problem (Steps 3 to 6). No request at all means the template never registered the asset, or you pasted the script in a Custom module that is unpublished: Joomla module not showing.
If the console is clean and the feature still “does nothing,” the script ran against markup that is not on this view. Inspect the DOM. CSS hiding the node is CSS changes not showing, not a JS failure.
Step 2: Put user.js on the media path of the active template
Cassiopeia loads user.js the same way it loads user.css: from the assigned template’s media folder.
On Joomla 4.1, 5, and 6:
media/templates/site/{template}/js/user.js
A child named cassiopeia_brand uses media/templates/site/cassiopeia_brand/js/user.js. A child does not load the parent’s user.js. If you added the file on Cassiopeia and then assigned the child, the public page will not request the parent script.
In Template Manager:
System → Templates → Site Templates → the active template (child if you have one).
New File. Select the js folder.
Filename: user with no suffix. File type: .js.
Create, paste, Save.
The Joomla 4.0-era path templates/cassiopeia/js/user.js is the same class of mistake as the old CSS folder. Current Cassiopeia looks in media/. Filename user.js.js 404s for the same reason as user.css.css.
Confirm the menu item’s Template Style. Home can use the child while the page you tested still uses the parent. Two styles, two user.js files.
Cassiopeia typically registers user.js through the Web Asset Manager as a deferred classic script, not as type="module". That matters in Step 4.
How to add JS through WAM, a Custom module, or an extension asset JSON: Add custom JavaScript to Joomla. This checklist stops when the file is in the right folder and the Network tab shows 200.
Step 3: Separate jQuery snippets from vanilla and from ES modules
Joomla 4, 5, and 6 front ends are not Joomla 3.
Cassiopeia uses Bootstrap 5. It does not enqueue jQuery for every page. $ and jQuery exist only if some extension called the jQuery asset (jquery / jquery-noconflict in the Web Asset Manager). A blog you copied that starts with jQuery(document).ready(...) will throw $ is not defined on a stock site.
Fixes that are honest:
Rewrite the snippet in vanilla JS (document.addEventListener('DOMContentLoaded', …)).
If you truly need jQuery, load it as a dependency of your asset, not by pasting a second copy of jQuery 1.12 into user.js. Duplicate jQuery is a classic conflict (Step 6).
ES modules: import / export are a SyntaxError in a non-module script. Cassiopeia’s user.js is a normal deferred file. Do not put import { … } from '…' in it unless you register that file as a module asset (type="module") in joomla.asset.json. Mixing module syntax into user.js is why “I followed a Vite example and Joomla exploded.”
document.write and inline onclick= in article HTML are separate from user.js. They fail for the same CSP reasons in Step 5, and they are harder to cache-bust. Prefer one file in the child.
Step 4: Account for defer, order, and DOM timing
Web Asset Manager can output defer (Cassiopeia’s user.js usually has it). Deferred scripts run in order after the document is parsed. They do not run before a script without defer that sits earlier in the HTML.
Typical races:
Your user.js assumes a calendar plugin’s global already exists. That plugin’s file is deferred later, or only loads on one menu item.
An inline script in a Custom module runs immediately, then user.js runs later and overwrites it (or the reverse).
You query #mod-finder-searchword on a page that has no finder module. querySelector returns null. The next line throws. The rest of user.js never runs. Put a guard around the node, or split files.
Do not “fix” order by pasting <script> into core index.php. Register dependencies in joomla.asset.json or load from the child the way the custom JavaScript guide describes. Official model: Web Asset Manager.
DOMContentLoaded in a deferred user.js may have already fired. If your snippet never runs, listen for DOMContentLoaded only when document.readyState === 'loading'; otherwise run immediately.
Step 5: Check Content-Security-Policy and mixed content
A file can 200 in Network and still never execute.
System → Plugins → System – HTTP Headers. If Content-Security-Policy is on, script-src may allow 'self' and block:
Inline <script> in a Custom module or article
eval / new Function (some older sliders)
A CDN copy of jQuery or analytics you added in user.js via a remote URL
unsafe-inline missing when you still have inline handlers
The console message is explicit: Refused to execute inline script or Refused to load the script 'https://…'. That is CSP, not a Joomla path bug. Loosen the policy on staging, or move the code into user.js on the same origin so 'self' allows it. Do not turn CSP off on production to “make a snippet work.”
HTTPS pages that still request http:// scripts are mixed content. The browser blocks them. Same class of failure as images not loading on HTTPS.
Server-level headers (Cloudflare, nginx add_header) override or duplicate the plugin. If the plugin is off and CSP still appears in Response Headers, fix the host, not Joomla.
Step 6: Isolate a conflict without guessing
Two scripts can both “work” and still cancel the feature.
Signs:
The console shows your console.log at the top of user.js, then a third-party file throws, then your click handler is missing.
Bootstrap’s data-bs-toggle stops after you load a second Bootstrap JS.
A Mootools-era extension and a modern module both bind window.onload.
On staging:
Backup.
System → Manage → Plugins. Batch-disable recently installed system plugins (not authentication). Retest.
Switch the page to stock Cassiopeia (parent style) with an empty user.js. If the extension feature returns, your script or the child’s JS is the conflict.
Do not debug this on production by disabling the Language Filter or Page Cache in public. Staging first.
Clear Joomla cache after JS changes. Page Cache will keep old HTML that does not include your new <script src>. Guests then look like “JS does nothing” while you, logged in, skip Page Cache and see it work. Same guest-vs-login split as cache showing old content.
Console first. Then jQuery versus module syntax. Then defer and order. Then CSP. Then the user.js path on the active template.
Key takeaways
Joomla JavaScript not working is a console diagnosis, not a reason to paste a second <script> into core.
Cassiopeia user.js is media/templates/site/{template}/js/user.js on the active template. A child does not load the parent file.
New File: name user, type .js. The old templates/…/js/ path is Joomla 4.0.
$ is not defined on stock Cassiopeia. Rewrite vanilla or declare jQuery as a Web Asset dependency. Do not ship two jQuery copies.
import belongs in a module asset, not in default deferred user.js.
Deferred order and a missing DOM node throw and abort the rest of the file.
CSP from HTTP Headers or the server will refuse inline and remote scripts even when Network is 200.
The console has a 404, a $ is not defined, a module SyntaxError, a CSP refusal, or an earlier exception that stopped the file. Read the first red line. Then confirm user.js is on the assigned template’s media path.
Where do I put user.js in Joomla 5?
media/templates/site/{template}/js/user.js, same pattern as user.css. Create it with filename user and type .js in the template’s js folder. Official customisation notes: Cassiopeia Template Customisation.
Does Joomla 5 still include jQuery on every page?
No. Cassiopeia does not load jQuery unless an extension (or your asset JSON) asks for it. Joomla 3 snippets that start with $ will fail on a stock 4, 5, or 6 site.
Can Content-Security-Policy block user.js?
'self' allows a same-origin user.js. It still blocks inline script in articles and many CDN URLs. Check the console for Refused to execute and the HTTP Headers plugin. Docs: HTTP Headers plugin.
Why does my script work in the administrator but not on the site?
Administrator uses Atum (or an Atum child). The site uses Cassiopeia (or a site child). user.js is per template. Put site scripts in the site child. Put admin scripts in an administrator child.
Should I add JavaScript in this article or in the how-to?
Use this page to find the failure. Use Add custom JavaScript to Joomla to register the file. Do not paste into core index.php.
I cleared cache and guests still run old JS. Why?
System – Page Cache stores full HTML. Logged-in users skip it. Clear cache, purge the CDN, test a private window. See cache showing old content.
Conclusion
When Joomla JavaScript is not working, the console already knows. 404 means the user.js path (child vs parent, media/ vs the old templates/ folder). $ is not defined means a Joomla 3 habit on a Cassiopeia page. import means a module in a classic deferred file. CSP means the headers, not SEF. Conflicts mean a second Bootstrap or a system plugin on staging, not a core hack.
The decimal number system is the same one we use on a daily basis. We employ decimals while dealing with money matters, determining distances, measuring the worth of products and during arithmetic computations. However, it’s the binary system that is utilized by computers since there are only two digits involved – zero and one – and the binary system represents numbers and other kinds of data stored in digital devices.
If you’re a beginner learner, understanding decimal to binary conversions would become a necessary skill, which might sound difficult to you but actually it’s too easy with certain steps and practice.
What Exactly is Decimal?
The decimal number system is also referred to as the base-10 numeral system since it employs ten digits, namely, zero till nine.
A position in a decimal number represents the power of ten. For instance, the decimal 245 can be put forth as-
245 = 2 × 100 + 4 × 10 + 5 × 1
Thus
245 = 200 + 40 + 5.
This place value system seems simple for people to comprehend and utilize.
And what’s a Binary number?
Binary is actually a base-2 numeral system where only two digits are used instead of ten:
0 and 1.
Each place in a binary number corresponds to the powers of two starting from right to left like-
1, 2, 4, 8, 16, 32, 64, 128 and so on.
Consider the binary 1011
This is expandable as-
1 × 8 + 0 × 4 + 1 × 2 + 1 × 1
this gives:
8 + 0 + 2 + 1 = 11
Hence, 1011 in binary is 11 in decimal.
How to convert it to binary from decimal?
You must have come across so many methods, but the division by 2 method is too easy when converting a whole decimal number to binary.
Keep dividing by 2 and writing down the remainder each time. Continue doing this until the quotient has become zero and then read the recorded remainders from bottom to top.
Let’s convert a few numbers for proper understanding;
Example 1: Convert 10 to binary
Divide 10 by 2 to begin with-
10 ÷ 2 = 5 remainder 0
Now,
5 ÷ 2 = 2 remainder 1
Next,
2 ÷ 2 = 1 remainder 0
Finally,
1 ÷ 2 = 0 remainder 1
And finally, read from bottom to top-
1010
Hence, 10 in decimal is equivalent to 1010 in binary. We can now check the answer using place values:
1010 = 1 × 8 + 0 × 4 + 1 × 2 + 0 × 1
= 8 + 2
= 10
So the answer is definitely correct.
Example 2: Convert 13 to binary
Keep repeating step 1 with the number 13-
13 ÷ 2 = 6 remainder 1
Then,
6 ÷ 2 = 3 remainder 0
Next,
3 ÷ 2 = 1 remainder 1
Finally,
1 ÷ 2 = 0 remainder 1
Hence, read from bottom to top-
1101
And thus, 13 in decimal is equivalent to 1101 in binary. Check using place values again:
1101 = 1 × 8 + 1 × 4 + 0 × 2 + 1 × 1
= 8 + 4 + 1
= 13.
Example 3: Convert 25 to binary
Let’s try a bigger number and convert it:
25 ÷ 2 = 12 remainder 1
12 ÷ 2 = 6 remainder 0
6 ÷ 2 = 3 remainder 0
3 ÷ 2 = 1 remainder 1
1 ÷ 2 = 0 remainder 1
Reading remainders from bottom to top we’ve:
11001
Hence, 25 in decimal is equivalent to 11001 in binary. Let’s put it up to check-
11001 = 1 × 16 + 1 × 8 + 0 × 4 + 0 × 2 + 1 × 1
= 16 + 8 + 1
= 25.
Alternative method: using powers of 2
Another basic method to convert a decimal number into a binary number would be to find out powers of 2 which add up to the decimal number and hence determine a binary value. Let’s find out the binary representation for decimal 18.
Powers of 2 are: 1, 2, 4, 8, 16, 32 and so on.
To sum 18, we require:
16 + 2 = 18.
So for 16 we will place a 1, then 0 for 8, 0 for 4, 1 for 2, and 0 for 1, hence,
10010.
Thus, 18 in decimal is equivalent to 10010 in binary.
This method is useful as it helps you know what particular position in a binary number represents.
Some errors made by beginners
There are a few errors commonly made by students when they are converting decimal numbers into binary numbers. Reading the remainders in the wrong order is one, then forgetting remainders (which have a value of 0 or 1), not continuing until the quotient has reached zero or incorrectly remembering what an equivalent place value represents. They mix them up; 10 is not the same as 2, but binary 10 is 2. In binary numbers, any position represented in place value stands for some power of 2 instead of 10.
Importance of decimal to binary conversion
Understanding decimal to binary conversion helps people understand how computers store different kinds of information. The values such as 0 or 1 each stand for 1 bit, which helps computers process information. Other subjects like digital logic, computer architecture or binary computation can also be understood.
When you need to check a conversion or work with different number-system values, a Binary Converter can also be useful for getting a quick result while learning the manual process.
What a user could think at the end of the session?
Converting decimal to binary can be seen as a task which depends on a few rules in the division method where numbers continue to get divided by 2 and recording the remainder each time until the quotient becomes zero and then reading remainders from bottom to top and hence obtaining binary values like:
10 = 1010, 13 = 1101, 18 = 10010, 25 = 11001, as demonstrated above using these binary values, this conversion task may seem much fun.
Joomla 6 is the current major CMS line. Joomla 3 reached end of life on 17 August 2023, and paid extended security support ended on 17 February 2025. A Joomla 3 site in 2026 is running core software the Joomla Project will not patch. Joomla 4 is not the destination either. Its security window closed on 14 October 2025. If you still have a 3.x site, the supported landing zone is Joomla 6.1.x (6.2 is next), not a 2021-era Joomla 4 install.
This page used to compare Joomla 4 and Joomla 3. That framing is outdated. Joomla 4 shipped on 17 August 2021 as the way off Joomla 3. Four years later, Joomla 4 is also unsupported. The question in 2026 is simpler: stay on an unpatched 3.x stack, or move to Joomla 6 on modern PHP.
Infyways has migrated Joomla sites since the Mambo era. If you want a managed cutover, use Joomla Upgrade. For the current 6.x train, see Joomla 6.
What you will learn
How Joomla 6 vs Joomla 3 compares on support, PHP, speed, security, templates, and SEO
What share of Joomla sites still run version 3, and why that majority is in the danger zone
Why Joomla 4 is no longer the upgrade target
Official dates you can cite (EOL, eLTS, current 6.x support)
The real upgrade path: 3.10 to 4.4 to 5.4 to 6.x (you cannot jump 3 to 6)
What usually breaks: Protostar, K2, old page builders, abandoned extensions
W3Techs (7 September 2026) reports this mix among websites it detects as Joomla:
Joomla version
Share of detected Joomla sites
Project patch status in Sep 2026
3.x
52.6%
None. Community support ended 17 Aug 2023. Paid eLTS ended 17 Feb 2025
5.x
20.6%
Supported (bugfix until 13 Oct 2026, security until 12 Oct 2027)
4.x
8.4%
None. Security support ended 14 Oct 2025
6.x
8.1%
Current line (bugfix until 17 Oct 2028, security until 16 Oct 2029)
2.x
5.9%
None. Retired years ago
1.x
4.3%
None. Retired years ago
How to read it:
About 1 in 2 Joomla sites is still on Joomla 3. That is not a rounding error. It is the majority of the public install base W3Techs can fingerprint.
About 71% are in the danger zone: versions 1, 2, 3, and 4 together (52.6 + 8.4 + 5.9 + 4.3). Those majors do not get official core patches.
Only about 29% are on a supported train: Joomla 5 plus Joomla 6 (20.6 + 8.1).
This is a website census, not a poll of “people.” W3Techs counts public sites it can identify. It will miss locked-down intranets. It can also lag a recent upgrade until the next crawl. Treat 52.6% as the public web’s Joomla 3 share, not as Infyways telemetry.
The share is falling, slowly. W3Techs’ version history had Joomla 3 around 61% in July 2025. A year later it is still over half. Migrations are happening. They are not happening fast enough to empty the unpatched pool.
Why Joomla 3 sites are in the danger zone
“Danger zone” here means unpatched core on the public internet, not a marketing label.
The core will not get another official fix. Any new Joomla 3 vulnerability stays open. Firewalls and Admin Tools lower noise. They do not replace a vendor patch. Community “dot 999” hardening is a stopgap, not a support contract.
Attackers prefer the popular leftover. When more than half of detected Joomla sites still answer as 3.x, scanners and exploit kits keep Joomla 3 fingerprints in rotation. You are not an interesting target. You are a matching banner.
The PHP under it is usually old too. Joomla 3 can boot on PHP 5.3.10. Many live 3.x sites sit on PHP 7.4 or 8.0 because a template or checkout dies on 8.3. Old PHP means old OpenSSL, ended distro packages, and a host that will someday force an upgrade and white-screen the site.
The extension layer is abandoned. Template and page-builder vendors have stopped Joomla 3 security work. A “patched” builder on unpatched core is still an unpatched CMS.
Joomla 4 is not a safe parking spot. Another 8.4% of detected sites are on 4.x, which lost security support on 14 October 2025. Migrating 3 to 4 and stopping leaves you in the same danger zone under a newer number.
Compliance already failed. PCI questionnaires, cyber insurance, and enterprise IT reviews ask whether the CMS still receives vendor patches. “Joomla 3.10.12” is a no. “We have not been hacked yet” is not a control.
If you are in that 52.6%, the risk is not theoretical. It is the default condition of an EOL CMS that most of the remaining Joomla web has not left. Upgrade path below. Incident first if you are already compromised: repair a hacked Joomla website.
Bugfix until 17 Oct 2028, security until 16 Oct 2029
Paid eLTS
Ended 17 Feb 2025
None
Not needed while 6.x is current
PHP minimum
5.3.10
7.2.5
8.3.0
PHP recommended
8.0 (late 3.x docs)
8.2
8.4
MySQL minimum
5.1 (InnoDB)
5.6
8.0.13
Frontend template
Protostar (Bootstrap 2 era)
Cassiopeia (Bootstrap 5)
Cassiopeia plus Cassiopeia Extended child
Admin template
Isis
Atum
Atum with CSS transitions
Core updates
Manual, unsigned in the old model
Manual, later TUF on 5.x
TUF-signed plus automatic core updates
Native child templates
No
From 4.1
Yes, including the Extended child in 6.0
MFA in core
Plugin era
First-class MFA
MFA plus POW captcha in 6.1
Web Services API
Limited / add-on era
Core web services
Core APIs, Framework 4
You should run this in 2026
No
No
Yes
Read that table as a support clock, not a feature brochure. Joomla 3 is not “old but patched.” It is unpatched core.
Joomla 3 administrator (Isis). This is still the backend on many sites that have had no official core patches since 2023.Joomla 4 administrator (Atum). Joomla 4 was the hop off 3.x. Security support for 4.x ended 14 October 2025, so it is not the 2026 destination.
Joomla 4 vs Joomla 3: what actually changed
Joomla 4 (released 17 August 2021) was a rebuild, not a facelift: it replaced Joomla 3’s Bootstrap 2 templates, legacy MVC classes and MooTools with Bootstrap 5, namespaced code and the Web Asset Manager, and raised the PHP minimum from 5.3.10 to 7.2.5. That is why moving from 3 to 4 breaks old extensions and templates, and why Joomla calls it a migration. Everything Joomla 4 introduced carried forward into Joomla 5 and 6, so the comparison below is also a list of what your Joomla 3 site gains on the way to Joomla 6.
Area
Joomla 3
Joomla 4
Minimum PHP
5.3.10 (3.10)
7.2.5
Front-end framework
Bootstrap 2
Bootstrap 5
Default templates
Protostar (site), Isis (admin)
Cassiopeia (site), Atum (admin)
JavaScript
MooTools and jQuery loaded by core
MooTools removed; assets managed by the Web Asset Manager
Code base
Legacy J-prefixed classes (JFactory, JText)
Namespaced classes; old names only via the Backward Compatibility plugin
Web Services API
None in core
Built-in REST API
Content workflows
Publish / unpublish only
Optional workflows with stages and transitions
Email
Hard-coded strings
Editable mail templates
Upgrade type from 3
Migration (Joomla calls 3.10 → 4 a “mini-migration”): core moves in one click, extensions and templates often need replacing
Security support
Ended 17 August 2023
Ended 14 October 2025
Should you stop at Joomla 4? No. Both columns above are end-of-life. Treat Joomla 4.4 as the bridge you must cross, then continue to 5.4 and 6. Before you start, check which extensions will break with a Joomla 6 compatibility check, and follow the full Joomla 3 to 6 upgrade guide.
Why you should upgrade now
Waiting made sense in 2022, when Joomla 4 was new and many extensions lagged. It does not make sense in September 2026.
There is no official Joomla 3 patch at any price. Community support ended 17 August 2023 (project announcement). The commercial eLTS programme closed 17 February 2025. Community hardening repos exist as a stopgap. They are not a product roadmap.
Joomla 4 is also closed. Teams that migrated 3 to 4 and stopped there are on another EOL line as of 14 October 2025. Stopping at 4 only delays the same job.
Hosts are dropping the PHP Joomla 3 was built for. Joomla 6 requires PHP 8.3 (8.4 recommended). Shared hosts that still offer PHP 7.4 or 8.0 are shrinking. A 3.x site that “works” on an old PHP pool is one host policy change away from a white screen. If the site is already down, treat it as an incident, then upgrade. Do not patch PHP on production and hope 3.x survives.
Extension vendors have left 3.x. Major template and page-builder shops have stopped Joomla 3 security work. A patched Helix or SP Page Builder on top of unpatched core is not a secure site.
Joomla 5.4 bugfix ends 13 October 2026, the same week Joomla 6.2 is planned. If you start from 3.x now, you still pass through 4.4 and 5.4. Starting after those windows close makes the staging work harder, not easier.
Insurers, payment processors, and enterprise IT questionnaires ask for supported software. “We are on Joomla 3.10.12” fails that test. PCI and cyber policies do not care that the site “has not been hacked yet.”
If the site is already compromised, fix the incident first: repair a hacked Joomla website. Then upgrade. Patching malware on Joomla 3 and staying there repeats the incident.
Speed: Joomla 6 vs Joomla 3
Joomla 3 can feel fine on a tiny brochure site with a CDN in front. The gap shows up in admin, multilingual sites, and anything that loads a pile of modules.
PHP is the largest lever. Joomla 3 can boot on PHP 5.3.10. Plenty of live 3.x sites still sit on PHP 7.4 because a template or VirtueMart fork dies on 8.x. Joomla 6 will not install below PHP 8.3. You pick up years of Zend engine, JIT, and opcode-cache work the 3.x codebase was never written to use. That is not a lab synthetic. It is the language runtime your host actually executes.
Joomla 6 caches language file parsing. The 6.0 release notes added a cache layer around languageHelper::parseIniFile. Multilingual and large language-pack sites spend less time re-parsing INI on every request. Joomla 3 does this the old way.
Asset loading is no longer “jQuery and Bootstrap 2 on every page.” Joomla 3’s Protostar stack is a custom Bootstrap 2.3.2 plus a jQuery era front end. Joomla 4 introduced the Web Asset Manager. Joomla 6 still uses it on Bootstrap 5.3. Extensions that opt in ship only the CSS and JS they need. A 3.x site with five club templates and a page builder often ships several jQuery copies. That is why speeding up Joomla on 3.x is mostly caching and images, while 6.x can also drop unused JS.
Admin is a different application. Isis on Joomla 3 was built for another decade of screens. Atum on 4/5/6 is the accessibility-first admin. Joomla 6 added CSS transitions in Atum and Cassiopeia so admin navigation feels less like a full reload. Editors on 3.x still complain that “Joomla admin is slow.” Often it is PHP workers plus Isis plus uncached language strings. Front-end caching help is in how to speed up Joomla.
Media and images. Joomla 6’s media manager can generate thumbnails for more file types, and 6.1 adds audio, video, and document custom fields. Joomla 3’s media manager is a drag for large libraries. Pair the CMS move with modern formats: WebP for Joomla.
Do not expect a magic “Joomla 6 is 40% faster” number. Measure TTFB and LCP on staging after PHP 8.4, cache, and image work. The consistent pattern we see: origin time drops when you leave PHP 7 and a Bootstrap 2 template, then front-end LCP drops when you stop shipping unused JS.
Security: Joomla 6 vs Joomla 3
Security is the reason to move, not a bullet on a marketing slide.
Unpatched core is the whole story on Joomla 3. New CVE-class bugs in 3.x stay open. Firewalls and “we have Admin Tools” reduce noise. They do not patch core. If you need the honest incident path, we wrote how to repair a hacked Joomla site.
Joomla 6 still gets a security train. Roadmap: regular bugfix for 6.x until 17 October 2028, security-only until 16 October 2029. That is years of project-signed fixes Joomla 3 will never receive.
Updates are signed and can be automatic. Joomla 5.1 introduced TUF-secured updates. Joomla 5.4 and 6.0 added automatic core updates for minor releases (example: 6.1.2 to 6.1.3). Joomla 3’s updater was a manual, often skipped, ritual. Sites die in the gap between “we will update next quarter” and a disclosed exploit.
MFA and bot friction are core. Joomla 4 made multi-factor authentication a first-class system plugin. Joomla 6.1 added a built-in proof-of-work captcha as a core alternative to Google reCAPTCHA. Joomla 3 sites still bolt this on, if they bother.
Password hashing and session handling moved with PHP. Staying on 3.x often means staying on old PHP. Old PHP means old OpenSSL, old hash APIs, and host packages that nobody is backporting.
SVG and media uploads. Joomla 6 improved SVG validation errors in Media Manager so a failed upload is a real diagnostic, not a vague XSS warning. Joomla 3 media uploads are a frequent malware drop if the site allows untrusted users.
Security is also template PHP. Protostar forks and “null” templates from 2016 execute on the same PHP as core. Joomla 6 child templates (how to set up a Joomla child template) let you keep CSS without forking core files that need patches.
Feature comparison: daily CMS work
Job
Joomla 3
Joomla 6
Edit an article
TinyMCE of that era, fewer field types
TinyMCE 8.x, notes and number custom fields, versioning that includes custom fields
Customise the design
Edit Protostar or duplicate the whole template
Child template of Cassiopeia; Cassiopeia Extended ships extra colour and font params
Native multilingual plus a language fallback chain in 6.2
Keep core patched
Manual, then impossible after EOL
TUF updates, optional automatic minor updates
Workflow
Limited
Graphical workflow editor in 6.1
Headless / app backend
Thin
Core Web Services, Framework 4
Accessibility
Partial
WCAG-oriented admin and frontend from the J4 rewrite onward
SEO defaults
SEF plus third-party SEO extensions
Same SEF model, cleaner HTML, better default robots/accessibility; still use a capable SEO extension if you need it
One correction to older “Joomla 4 vs 3” posts, including the 2023 version of this URL: Joomla 3 already had native multilingual. Joomla 6 does not “add languages.” It makes incomplete language packs less painful and keeps the rest of the stack on a supported PHP line.
What usually breaks on the way off Joomla 3
Plan for these. They are why a 3 to 6 job is a migration, not a one-click installer.
Protostar and Isis. They do not come across as Cassiopeia and Atum. Rebuild the look as a Cassiopeia child, or replace with a Joomla 6-ready commercial template. Do not copy Protostar PHP into 6.
K2. K2 is a Joomla 3-era content stack. Move K2 items into core articles or a J6-ready CCK. Infyways runs this as K2 migration.
VirtueMart and old checkout. Test every payment plugin on PHP 8.3. Some gateways never shipped J4+ builds. That is a commerce project, not a core bump. See VirtueMart upgrade.
Page builders and Helix/SP Page Builder 3-era sites. Vendor J6 builds exist for current product lines. Joomla 3-only licences do not. Budget a rebuild of landing pages if the builder is abandoned.
Overrides.html/com_content copies from 2014 will fatal on namespaced J6 classes. Inventory overrides before you touch production.
SEO URLs. Most menu aliases survive. Third-party sh404SEF or similar needs a J6-native replacement or a redirect map. Do not go live without a 301 sheet.
You cannot jump from Joomla 3 to Joomla 6
The installer will not let you. GitHub’s 6.0 notes are explicit for the last hop: do not update to 6.x from anything below 5.4. Get to 5.4 first.
Practical path we use on client sites:
Joomla 3.10.12 (last official 3.x) with a full backup
Staging clone, PHP raised as far as 3.10 will run (often 8.0) so the pre-update checker works
Migrate 3.10 to 4.4 (this is the hard hop: templates and extensions)
Upgrade 4.4 to 5.4 (upgrade, not a second migration, if extensions dropped J3-only APIs)
Enable the Behaviour – Backward Compatibility 6 plugin on 5.4, then upgrade 5.4 to 6.1.x
Retest, then plan to turn the compatibility plugin off once vendors are native
Official notes: Joomla 5.4 to 6.0 migration. For the 3 to 4 hop, Joomla’s 3.10 pre-update checker is still the right first screen. We also keep a dedicated walkthrough at Joomla 3 to Joomla 4 upgrade because that hop is where most sites stall.
Step 1: Inventory the Joomla 3 site
Record Joomla version, PHP, MySQL/MariaDB, and host.
Export the extension list (core, libraries, templates, modules, plugins).
Mark each item: Joomla 6-ready, replace, or drop.
List overrides, custom cron, payment callbacks, and multilingual associations.
Capture Search Console, analytics, and a crawl of indexable URLs.
Filter the Joomla Extensions Directory by Joomla 6. If a vendor vanished in 2019, budget a replacement now. Do not discover it on launch night.
Step 2: Fix hosting and PHP first
Joomla 6 needs PHP 8.3+, MySQL 8.0.13+ or MariaDB 10.4+ (10.6 supported, 12.0 recommended), and enough PHP memory (plan 256MB). Raise staging to the J6 target PHP before you chase template bugs. If production cannot offer PHP 8.3, change host before you change CMS. A 6.x site on an old PHP pool will not install.
Step 3: Stage, never upgrade live first
Full files plus database backup, stored off the server.
Clone to staging with the same PHP you will use in production for the current hop.
Disable or remove junk extensions on the clone.
Run 3.10 to 4.4 on staging until frontend, login, forms, and checkout work.
Only then continue 4.4 to 5.4 to 6.1.x on that clone.
If staging is not possible, do not improvise on production. That is how “upgrade” becomes an outage. Infyways can run the clone under Joomla Upgrade or outsource Joomla services.
Step 4: Rebuild the template as a child, not a fork
On Joomla 6, create a child of Cassiopeia (or use Cassiopeia Extended) and move only CSS, logo, and overrides you still need. Do not paste Protostar index.php into 6. Details: Joomla child template setup. For a full visual rebuild, Joomla design services.
Cut over in a low-traffic window with a restore point. Then watch logs for 48 hours. Ongoing patching belongs on a retainer: Joomla support and maintenance.
Key takeaways
Most detected Joomla sites are still on 3.x. W3Techs (7 Sep 2026): 52.6% on version 3. About 71% sit on 1.x, 2.x, 3.x, or 4.x, none of which get official core patches.
Joomla 6 vs Joomla 3 is not a style debate. Joomla 3 has had no official core patches since August 2023. eLTS ended February 2025.
Do not migrate 3 to 4 and stop. Joomla 4 security support ended 14 October 2025. Land on Joomla 6.1.x.
Speed comes from PHP 8.3/8.4, Web Assets, language-file caching, and dropping Bootstrap 2 templates, not from a slogan.
Security comes from a supported train: TUF-signed updates, optional automatic minor updates, MFA, and vendors who still ship J6 builds.
You cannot jump 3 to 6. Path is 3.10 to 4.4 to 5.4 to 6.x on staging.
Budget template, K2, and checkout work. Core is the easy part. Overrides and abandonware are the project.
What percentage of Joomla sites still use Joomla 3?
W3Techs reported 52.6% of detected Joomla sites on version 3 on 7 September 2026. About 71% are on any unsupported major (1, 2, 3, or 4). Source: W3Techs Joomla usage.
Is Joomla 3 still supported in 2026?
No. Official community support ended 17 August 2023. Paid eLTS ended 17 February 2025. There is no official Joomla 3 core patch at any price. That is why the 52.6% still on 3.x are in the danger zone.
What is the difference between Joomla 4 and Joomla 3?
Joomla 4 moved from Bootstrap 2 to Bootstrap 5, replaced the Protostar and Isis templates with Cassiopeia and Atum, removed MooTools, switched to namespaced code, added a REST Web Services API, workflows and mail templates, and raised the PHP minimum from 5.3.10 to 7.2.5. Both versions are now end-of-life, so use Joomla 4.4 only as a step towards Joomla 6.
Should I upgrade Joomla 3 to Joomla 4 or Joomla 6?
Go to Joomla 6. Joomla 4 is a required hop on the path, not the destination. Joomla 4 security support ended 14 October 2025.
Can I upgrade directly from Joomla 3 to Joomla 6?
No. Update to 3.10, migrate to 4.4, upgrade to 5.4, then to 6.x. Do not skip 5.4. The project tells you not to update to 6 from anything below 5.4.
What PHP version does Joomla 6 need compared with Joomla 3?
Joomla 6 requires PHP 8.3.0 minimum and recommends 8.4. Joomla 3.10’s absolute minimum is PHP 5.3.10. That gap is why many 3.x sites cannot even install 6 until hosting changes.
Is Joomla 6 faster than Joomla 3?
Usually yes on real hosting, because you leave PHP 7 and Bootstrap 2, and 6.x caches language parsing and uses the Web Asset Manager. Measure on staging. Do not quote a fake percentage.
Will my Joomla 3 template work on Joomla 6?
Almost never if it is Protostar or a 2016 club fork. Rebuild as a Cassiopeia child or replace with a Joomla 6-ready template.
What about K2 sites still on Joomla 3?
Migrate K2 content before or as part of the CMS move. Core articles or a J6-ready CCK, not a K2 install on Joomla 6. See Joomla K2 migration.
How long does a Joomla 3 to Joomla 6 upgrade take?
A small brochure site with a replaceable template can be days on staging. A VirtueMart plus page-builder plus 80 extensions site is weeks. Inventory first. Infyways quotes after that list, not before: Joomla Upgrade.
Conclusion
Joomla 6 vs Joomla 3 is a supported CMS versus an unpatched one. W3Techs still finds 52.6% of detected Joomla sites on version 3. Speed and UX are real. They are not why you should move this quarter. You should move because that majority is already in the danger zone: no official core patch, aging PHP, abandoned extensions, and Joomla 4 already closed behind you.
Inventory extensions, raise PHP on a clone, walk 3.10 to 4.4 to 5.4 to 6.1.x, and rebuild the template as a child. If you want that done without gambling on production, start with Joomla Upgrade or hire Joomla developers.
Short answer: To enable caching, go to System → Global Configuration → System and set System Cache to Conservative. To disable it, set it to OFF (and disable the System – Page Cache plugin). To clear it, go to System → Clear Cache, select all and delete. Then purge any server, CDN or browser cache. For choosing the right caching setup, read our Joomla caching strategy guide.
Joomla caching stores generated HTML or module output so the next visitor gets a faster response without rebuilding the page from the database every time. You control three layers: Global Configuration System Cache (Off, Conservative, or Progressive), the System – Page Cache plugin for full-page snapshots (guests), and module-level cache choices. Clearing cache is System → Clear Cache (or Maintenance → Clear Cache on some layouts). The same model applies on Joomla 3, 4, 5, and 6. Official overview: Joomla Cache documentation.
This guide is the operations playbook: when to turn each layer on, how to turn it off for debugging, how to purge safely, and how to stop fighting CDN or browser cache that is not Joomla at all. If Clear Cache does nothing to storage, see Joomla cache not clearing. If you published and still see yesterday’s HTML, see cache showing old content. For speed work beyond cache: speed up Joomla.
What you will learn
What each Joomla cache layer actually stores
Conservative vs Progressive vs Page Cache (and when Progressive bites)
Views/modules you allow (module Advanced → Use Global / No caching)
Guests mainly for shared output
Global Configuration + per-module
Progressive
Broader module combinations; overrides many per-module “No caching” expectations
Guests; easy to show wrong modules on wrong pages
Global Configuration
System – Page Cache
Full HTML page snapshot
Guests only (logged-in users bypass)
Plugins → System – Page Cache
CDN / host / browser
Edge or client copies
Everyone who hits that layer
Cloudflare, LiteSpeed, browser
Global System Cache alone does not equal full-page caching. Page Cache is a separate plugin. That distinction is the number one agency misunderstanding.
Recommended defaults (production vs build)
Situation
System Cache
Page Cache plugin
Notes
Active development / styling
Off
Disabled
Otherwise you chase ghosts
Content-heavy marketing site
Conservative
Enable after testing
Set dynamic modules to No caching
Rarely changing brochure site
Conservative or carefully tested Progressive
Often enabled for guests
Progressive needs QA on module assignment
Membership / cart / personalized UI
Conservative + strict module exclusions
Use exclusions or keep Off on private paths
Never assume Page Cache is safe on personal pages
Step 1: Open Cache Settings
Log in to Administrator.
Go to System → Global Configuration.
Open the System tab.
Find Cache Settings.
Typical fields (labels vary slightly by version):
Field
Meaning
System Cache
Off / Conservative / Progressive
Cache Handler
Usually File; APCu, Redis, or Memcached when PHP extensions and host support them
Cache Time
Minutes until an entry expires (default often 15)
Path to Cache Folder
Leave blank for default cache/ unless you have a deliberate custom path
Set Cache Handler to File unless your host already standardized on Redis/Memcached and you know how to flush it.
Set Cache Time (start at 15–60 minutes; raise after you trust purge habits).
Save.
For each module that must stay dynamic (cart, login, personalized greetings), open the module → Advanced → set Caching to No caching.
Leave stable modules on Use Global.
Conservative is the default you should prefer on client sites unless you have a reason and a test plan for Progressive.
Step 3: Enable Progressive caching only with eyes open
Set System Cache to ON – Progressive caching.
Save and clear cache.
Walk key menu items as a guest. Confirm modules appear only where assigned.
If a module “follows” you across pages incorrectly, switch back to Conservative immediately.
Progressive is faster on paper and famous for wrong-module-on-wrong-page tickets. Treat it as an advanced mode, not a trophy setting.
Step 4: Enable System – Page Cache (full pages for guests)
Go to System → Manage → Plugins (or Extensions → Plugins on older menus).
Search for System – Page Cache.
Enable it.
Review plugin options (browser cache, exclusions) for your version.
Clear cache.
Test as guest in a private window, then as a logged-in user.
Page Cache is the biggest win for anonymous traffic. Logged-in sessions normally bypass it. If editors say “I see the update but visitors do not,” clear the page cache group and check CDN.
Step 5: Disable caching for debugging
Use this order when something looks stale or broken:
Disable System – Page Cache plugin.
Set Global System Cache to OFF – Caching disabled.
Clear Cache (Delete All).
Bypass CDN (origin URL or development mode) and use a private browser window.
Reproduce the bug.
Re-enable Conservative (and Page Cache if needed) only after the fix is confirmed.
Do not leave production on Off after a support call ends.
Step 6: Clear cache in Administrator
Clear all
Go to System → Clear Cache (sometimes under Maintenance).
Check all groups or use Delete All / equivalent.
Confirm the list empties or refreshes.
Clear one group
Open Clear Cache.
Tick a group such as page (Page Cache plugin) or a component/module group.
Delete.
After content edits on a Page Cache site, clearing the page group is the move that fixes “guest still sees old article.”
CLI (when you automate)
From the site root, modern Joomla installs can use the console cache clean command provided by your version (joomla.php / CLI entry). Wire it into deploy hooks so releases purge File or Redis consistently. If the Admin broom works but Redis still serves old HTML, the handler was not File: cache not clearing.
Step 7: Clear what is not Joomla
Layer
How to purge
Cloudflare / CDN
Purge URL or cache everything after major publishes
LiteSpeed / host page cache
Host panel or LSCache purge
Browser
Private window or hard refresh
Opcode (APCu/OPcache)
Host restart or panel tools after PHP deploys
Joomla Clear Cache never empties Cloudflare by itself.
Handler cheat sheet
Handler
Use when
Watch-out
File
Default shared hosting
Permissions on cache/; disk full
APCu
Single-server PHP with APCu
Not shared across multiple app servers
Redis / Memcached
Multi-node or high traffic
Must flush the right instance; FTP delete of cache/ does nothing
Always match Clear Cache expectations to the handler you configured.
Guest vs logged-in checklist
Publish the change.
Open a private window logged out. That is the Page Cache audience.
Open the same URL logged in. You may see fresher HTML.
If only guests are stale, purge Page Cache + CDN.
If both are stale, check Progressive/Conservative and module cache, then CDN.
Conservative + selective module exclusions is the safe production baseline.
Page Cache is separate and mainly for guests. It is the big anonymous speed win.
Progressive is optional and easy to misconfigure.
Clear the layer that served the response: Joomla groups, then CDN, then browser.
Match purge method to Cache Handler (File vs Redis).
Frequently asked questions
How do I enable cache in Joomla?
Open Global Configuration → System → Cache Settings, set System Cache to Conservative (recommended) or Progressive, save, then optionally enable the System – Page Cache plugin for guest full-page caching.
How do I disable cache in Joomla?
Set System Cache to Off and disable the System – Page Cache plugin, then Clear Cache. Also bypass CDN while debugging.
How do I clear cache in Joomla?
Use System → Clear Cache and Delete All, or delete specific groups such as page. Flush Redis/Memcached if that is your handler.
What is the difference between Conservative and Progressive caching?
Conservative respects module-level “No caching” choices more sanely for mixed sites. Progressive caches module combinations more aggressively and often causes assignment bugs.
Does Page Cache work for logged-in users?
Normally no. System – Page Cache is aimed at guests. Logged-in users generate personalized output.
Why do visitors still see old content after I clear cache?
Another layer is hot: CDN, host cache, or browser. Or Page Cache was not cleared. See cache showing old content.
Should I use Redis instead of File?
Use Redis when traffic or multi-server architecture needs it and your team can flush it on deploy. File is fine for many sites.
Does this guide apply to Joomla 4, 5, and 6?
Yes. Menu labels move slightly, but Off / Conservative / Progressive, handlers, Clear Cache, and System – Page Cache remain the core model.
Joomla SEF URLs (Search Engine Friendly URLs) turn long query strings into readable paths built from menu and content aliases. Enable Search Engine Friendly URLs in Global Configuration so Joomla builds paths like /index.php/news/my-article. Enable Use URL Rewriting and activate the server rewrite file (.htaccess, web.config, or nginx rules) so index.php disappears and you get /news/my-article. The same settings apply on Joomla 3, 4, 5, and 6. Official overview: Search Engine Friendly URLs.
SEF is not a ranking switch. It is URL hygiene: clearer links for people, crawlers, and analytics. Pair it with solid aliases, one canonical host, and redirects when you rename paths. Deep server rewrite help: Joomla .htaccess guide. Redirect layers: Joomla Redirect Guide. Broader SEO: full Joomla SEO checklist.
What you will learn
What SEF URLs are in Joomla (and what they are not)
The difference between SEF URLs and URL rewriting
Exact Global Configuration switches, including Unicode aliases and .html suffixes
Step-by-step setup on Apache/LiteSpeed, IIS, and nginx
How menus and aliases actually build the path
Duplicate URL traps, multilingual SEF, and API routes on Joomla 4+
A verification and troubleshooting matrix agencies use on go-live
Not an SEF path setting, but sits in the same SEO mental model
Tip from the official guide: after changing SEO settings, hard-refresh open front-end tabs. Stale browser tabs make internal links look broken when they are only cached against the old format.
Do not casually flip SEO settings on a live indexed site. Changing suffix, Unicode behavior, or rewrite mode can orphan old URLs. Plan 301 redirects first.
Step 1: Decide the target URL shape
Write down three example URLs you want live:
Home
A category/blog listing
One article under a menu item
Agree on:
www vs bare host
HTTPS only
Trailing slash policy (be consistent; do not mix randomly)
Whether .html suffixes are required (usually not)
If those are undecided, fix hosting and redirects before SEF theater.
Step 2: Activate the server rewrite file
Apache / LiteSpeed / OpenLiteSpeed
In the Joomla root (same folder as configuration.php), rename htaccess.txt to .htaccess.
If the site lives in a subdirectory, set RewriteBase /yourfolder/.
If you get HTTP 500, comment Options +FollowSymlinks as hosts often forbid it.
Rename web.config.txt to web.config, then enable Use URL Rewriting.
nginx
.htaccess does nothing. Use try_files to index.php (and /api/ → api/index.php on Joomla 4+). Keep Use URL Rewriting aligned with that nginx config.
Step 3: Turn on SEF, then rewriting
Open System → Global Configuration.
Set Search Engine Friendly URLs to Yes. Save.
Confirm front-end links look like /index.php/... style SEF paths.
Set Use URL Rewriting to Yes. Save.
Confirm index.php is gone from normal menu URLs.
Enable System – SEF plugin if it is not already enabled (Plugin Manager). It helps SEF-ify many links embedded in content HTML.
Order matters: rename/configure rewrite first (or immediately before enabling rewriting). Enabling rewriting with no rewrite engine produces widespread 404s.
Step 4: Control aliases like a product manager
Aliases are the vocabulary of your URLs.
Set a clear menu alias for each important Itemid path.
Set article/category aliases deliberately. Auto-alias from title is fine for drafts; edit before publish for money pages.
Avoid duplicate aliases under the same parent context.
Prefer short, stable aliases. Do not stuff every keyword into the slug.
When you rename an alias on an indexed URL, add a 301 the same day.
Joomla builds paths from the active menu tree more than from “category folders” alone. Two menu items pointing at similar content can create two valid URLs. That is an IA problem, not an SEF bug.
Step 5: Multilingual SEF
On multilingual sites:
Each language needs its own menu tree and associations where required.
Language codes or domains must be planned (subdirectory vs domain).
Do not enable Unicode aliases casually if half your audience cannot type those characters.
Test language switcher targets resolve to associated items, not 404s.
Native multilingual is a Joomla strength. SEF mistakes show up as “wrong language URL” tickets faster than on monolingual sites.
Step 6: Joomla 4+ API routes vs site SEF
Modern stock .htaccess routes /api/ to api/index.php for Web Services. Site SEF and API routing share the rewrite engine but different front controllers. If pretty site URLs work but /api/v1/... 404s, your .htaccess may be an old Joomla 3-era file missing the API block. Merge forward from current htaccess.txt.
Duplicate URLs and canonical hygiene
Common duplicate classes:
Pattern
Cause
Fix
/index.php/alias and /alias both 200
Rewrite on, but old links still circulate
301 index.php variants to clean URLs at server or redirect component
Same article under two menus
Two Itemids
Pick one primary menu path; redirect or noindex the other
Search engines tolerate some duplication. Humans and analytics do not.
Performance notes
SEF itself is cheap compared with uncached page generation. Rewriting is handled by the web server before PHP for the route hop. Performance work still belongs in caching, images, and extension hygiene (speed up Joomla if you maintain that URL). Do not disable SEF “for speed” unless you have measured a real rewrite misconfiguration.
Clear Joomla and CDN cache; confirm you edited the live Global Config
Only some article links stay ugly
Hard-coded non-SEF links in content
Enable System – SEF; edit content; use Joomla link picker
Works on Apache staging, fails on nginx prod
.htaccess unused
Write nginx try_files
API 404 on J4+
Old rewrite file
Add /api/ block from modern htaccess.txt
Sudden ranking dip after SEO flips
URL shape changed
Restore pattern or 301 old → new
Key takeaways
SEF URLs make paths readable. Rewriting removes index.php. They are separate switches.
Activate the server rewrite file before or as you enable Use URL Rewriting.
Aliases and menu structure define the URL vocabulary more than a mythical “category folder” alone.
Changing SEO settings on a live site without redirects creates avoidable debt.
Keep .htaccess / nginx / IIS rules current when you move across Joomla 3 → 4 → 5 → 6.
Frequently asked questions
What are Joomla SEF URLs?
They are human-readable Joomla URLs built from aliases instead of long option= query strings. See the official SEF documentation.
How do I enable SEF URLs in Joomla?
Set Search Engine Friendly URLs to Yes in Global Configuration. To remove index.php, also enable Use URL Rewriting after configuring .htaccess, web.config, or nginx.
Why do I still see index.php in my URLs?
Use URL Rewriting is Off, or the server rewrite file is missing or ignored. SEF alone keeps index.php in the path.
Do I need .htaccess for SEF?
Not for SEF generation. Yes for Apache/LiteSpeed rewriting that removes index.php. Details: htaccess-joomla.
Should I add .html suffixes to Joomla URLs?
Usually no. Suffixes are optional cosmetics. Changing them later forces redirects across the site.
What are Unicode aliases?
When Yes, Joomla can keep native characters in new aliases instead of transliterating to ASCII. Choose based on audience and keyboard reality. It does not mass-convert existing aliases.
Will enabling SEF improve Google rankings by itself?
Not by itself. Clean URLs help usability and consistency. Rankings still need content, links, crawl health, and technical SEO.
How do I fix SEF 404 errors after enabling rewriting?
Turn Use URL Rewriting Off to confirm, restore or fix the rewrite file, set RewriteBase for subfolders, then re-enable. Use the troubleshooting matrix above.
Does this apply to Joomla 4, 5, and 6?
Yes. The Global Configuration switches and rewrite workflow are the same family. Modern files add /api/ routing for Web Services.
The benefits of using Joomla are strongest when you need native multilingual sites, fine-grained access control, workflows, and structured content without assembling five plugins to get a baseline CMS. Joomla is not the most popular CMS on the public web. Measured by W3Techs in September 2026, it powers about 1.7% of sites with a known CMS (about 1.1% of all websites). WordPress leads by a wide margin. The case for Joomla is architectural fit, upgrade discipline on the modern 5.x/6.x line, and total cost when “plugin glue” becomes the real product.
This article is the honest, evidence-first version of “why Joomla.” It uses public telemetry, a version mix chart most “benefits” posts ignore, and a capability scorecard that separates popularity from product strength. For equal-weight CMS comparison, see Joomla vs WordPress and Joomla 6.1 vs WordPress 7.1. For the current release line, see Joomla 6.
What you will learn
What public market-share numbers actually say (and what they do not)
Why more than half of detected Joomla sites still run version 3, and what that means for buyers
The core benefits that show up in real projects: multilingual, ACL, fields, workflows, SEO controls, Web Services
Choose Joomla when the site is a system of permissions, languages, and structured sections. Choose WordPress when the site is a content marketing machine with maximum plugin gravity. Choose Drupal when you want enterprise information architecture and can staff for it.
Popularity is a hiring and ecosystem signal. It is not a feature checklist.
CMS market share among sites whose CMS W3Techs can identify. Source: W3Techs, August–September 2026.
How to read this without fooling yourself
WordPress wins the density war: freelancers, themes, WooCommerce, tutorials.
Joomla still outranks Drupal on overall public install share in these surveys, while Drupal often punches above its weight in higher-traffic bands (see W3Techs ranking breakdowns).
SaaS builders (Shopify, Wix, Squarespace) took much of the “easy brochure site” demand that older open-source CMS fought over a decade ago. That is market structure, not a feature score for ACL or multilingual.
Version mix among Joomla sites (the chart almost nobody publishes)
On 6 September 2026, W3Techs reported this mix among sites that use Joomla:
Version
Share of Joomla sites
Joomla 3
52.6%
Joomla 5
20.6%
Joomla 4
8.4%
Joomla 6
8.0%
Joomla 2
5.9%
Joomla 1
4.3%
Over half of detected Joomla sites still report version 3. Modern 5.x/6.x share is rising but is not the majority yet. Source: W3Techs, 6 September 2026.
It shows the product story for 2026 is not “everyone already left.” It is “many estates are lagging the modern core.”
Benefits of current Joomla (5.4 LTS bridge and 6.1.x) only apply if you are actually on those lines. Staying on unmaintained 3.x is not a Joomla benefit. It is technical debt.
Forked from Mambo on 17 August 2005; GPL-2.0; Open Source Matters (project history)
Codebase activity
joomla/joomla-cms on GitHub: on the order of 5k+ stars, thousands of forks, continuous release train into 2026
Security cadence
Parallel 5.4.x and 6.1.x security/bugfix drops (example: 18 August 2026)
Extension ecosystem
Thousands of listings on the Joomla Extensions Directory, smaller than WordPress.org plugins, stronger specialist density for Joomla-native problems
Capability scorecard: where Joomla actually scores
The chart below is an editorial score out of 5 for mid-market sites that need more than a blog. It is not W3Techs data. It exists so buyers stop confusing “most websites use X” with “X has the best native ACL.”
Editorial core-capability scores for typical mid-market builds. Plugin density and hiring favor WordPress. Multilingual and ACL favor Joomla. Drupal remains strong on complex IA and ACL with higher staffing cost.
Benefit 1: Native multilingual without a plugin maze
Joomla ships language packs, content associations, language switcher patterns, and per-language menus as first-class concepts. For associations, government, education, tourism, and regional brands, that core model reduces “which plugin owns translations this year” risk.
Proof in practice: fewer moving parts means fewer upgrade breakages when language plugins churn. You still need translation workflow and quality control. The CMS does not invent good copy.
Benefit 2: Access Control Lists that match real organizations
Joomla’s ACL (user groups, access levels, asset permissions) is designed for multi-role publishing: editors who can change Category A but not Category B, front-end submitters, department sites, extranets.
WordPress roles are simpler out of the box. Fine grain usually means membership plugins or custom capabilities. Drupal also has deep permissions. Joomla’s advantage is depth with a friendlier mid-market curve than Drupal for many agency teams.
Benefit 3: Structured content in core (fields, categories, tags, workflows)
Custom Fields, nested categories, tags, and workflows let you model products, directories, people, and case studies without bolting on a second content engine on day one. That is the modern replacement path for many K2-era patterns (K2 migration notes).
Benefit 4: SEO controls that sit next to content
SEF URLs, menu-driven information architecture, metadata per item, sitemaps via extensions or core-adjacent tooling, and clean .htaccess rewriting on Apache/LiteSpeed (htaccess guide). Joomla does not magically rank. It gives editors structured places to set canonical intent when the IA is planned well. Broader SEO playbook: Joomla SEO.
Benefit 5: Security model that starts with permissions, not “install a shield plugin”
No CMS is “secure by brand.” Joomla’s benefit is that least-privilege ACL, MFA options on modern lines, and a serious core security release process exist before you buy a firewall extension. You still must patch core and extensions. August 2026 core advisories are a reminder that updates are the benefit, not a slogan (6.1.3 / 5.4.8). Field hardening: Joomla security.
Benefit 6: Web Services and modern PHP for headless or hybrid builds
From Joomla 4 onward, the Web Services API and stock rewrite rules for /api/ support headless and hybrid fronts (including Next.js cases). That matters when marketing wants a modern front end but operations still need Joomla’s content and ACL model.
Benefit 7: Total cost when the alternative is plugin debt
WordPress can be cheaper to start. Joomla can be cheaper to own when the alternative is five premium plugins for multilingual, membership, fields, workflow, and role editors, plus the labor to keep them compatible every quarter.
Run the spreadsheet: licenses + hours + failure risk. That is the real benefit calculation.
Benefit 8: Open source with no per-seat CMS tax
Joomla is GPL-2.0. You pay hosting, people, and extensions you choose. You do not pay a CMS vendor per editor seat for the core. Governance longevity past 20 years is documented in the project’s own 21st anniversary retrospectives.
Feature table: benefits vs common alternatives
Need
Joomla benefit
Watch-out
Multilingual corporate site
Native associations and language framework
Plan IA and fallback languages early
Departmental publishing rights
Native ACL
Design groups before content volume explodes
Brochure site for a local shop
Possible, but often overkill
WordPress or a site builder may be faster
Woo-style commodity commerce
VirtueMart and others exist
WooCommerce ecosystem is larger
Maximum freelance supply
Smaller pool
Budget for specialists; quality can be high
Long-lived custom portal
Overrides, components, fields, API
Needs coding standards and staging discipline
Staying on Joomla 3 forever
Not a benefit
Upgrade path to 5.4 then 6.x
Who should use Joomla in 2026
Strong fit
Multilingual public-sector, education, association, and tourism sites
Intranets / extranets with real permission matrices
Content estates migrating off Joomla 3 or K2 into modern com_content
Hybrid headless where ACL still lives in Joomla
Agencies that already staff Joomla and want predictable core features
Weak fit
Solo marketers who live inside Gutenberg and WooCommerce tutorials
Teams that cannot hire or retain a Joomla-capable maintainer
Projects that need the absolute largest plugin marketplace as a first principle
Sites that will never leave unmaintained Joomla 3
Myths the data kills
Myth
Reality
“Nobody uses Joomla anymore.”
~1.1% of all sites and ~1.7% of known-CMS sites is smaller than WordPress, not zero (W3Techs).
“Market share proves WordPress is always better.”
Share proves ecosystem density. Feature fit is separate (see scorecard).
“Joomla 6 means everyone upgraded.”
Detected mix still shows a Joomla 3 majority among Joomla sites as of 6 Sep 2026.
“Benefits articles should only cheerlead.”
Honest constraints build trust and better project selection.
Implementation checklist if you choose Joomla
Target Joomla 5.4.x or 6.1.x, not legacy 3.x for new work.
Inventory extensions for J6 readiness before go-live.
Design ACL groups and languages in week one, not month six.
Use staging, backups, and a written upgrade path (upgrade services).
Keep .htaccess / nginx rewrite rules correct for SEF and API (htaccess guide).
Measure success as editor throughput and permission incidents, not vanity CMS rankings.
Key takeaways
Joomla’s best benefits are native multilingual, ACL, structured content, and open-source ownership, not winning a popularity contest.
W3Techs puts Joomla near 1.7% of known CMS and 1.1% of all sites in 2026 snapshots. Use that for ecosystem planning.
More than half of detected Joomla sites still report version 3. Modern benefits require modern versions.
WordPress still wins plugin density and hiring ease. Drupal remains an enterprise IA peer.
Pick Joomla when the product is a permissioned, multilingual system. Otherwise pick the tool your team can operate.
Frequently asked questions
What are the main benefits of using Joomla?
Native multilingual support, fine-grained ACL, custom fields and workflows, solid SEO building blocks, Web Services for hybrid builds, and GPL licensing without a core seat tax.
Is Joomla still used in 2026?
Yes. W3Techs still measures it at roughly 1.7% of known CMS sites and 1.1% of all websites as of September 2026.
Is Joomla better than WordPress?
Not universally. Joomla is often better for multilingual and ACL-heavy sites. WordPress is often better for marketing sites that need maximum plugins and freelancers. See Joomla vs WordPress.
What is the latest Joomla version?
Joomla 6.1.3 is the current 6.x stable as of the 18 August 2026 security release, with 5.4.8 on the 5.x line. Verify on downloads.joomla.org.
Why do so many Joomla sites still run version 3?
Upgrades need extension readiness, budget, and testing. W3Techs’ September 2026 mix shows 52.6% of detected Joomla sites still on version 3. That is debt, not a feature.
Does low market share mean Joomla is dying?
Low share means a smaller mainstream funnel. The project still ships modern majors, security releases, and GitHub activity into 2026. Fit matters more than podium finishes.
When should I avoid Joomla?
Avoid it when your team only knows WordPress plugins, when you need commodity WooCommerce depth, or when nobody will maintain upgrades.
Updated 15 October 2026 · By Abhilash Sahoo, Founder, Infyways
Quick answer: Joomla ships its Apache rules as htaccess.txt in the site root. To use it:
Copy or rename it to .htaccess.
Turn on System → Global Configuration → Site → Use URL Rewriting to remove index.php from URLs.
Put your own redirects (HTTPS, www) inside the file’s Custom redirects block.
If the site shows a 500 error, comment out Options +FollowSymlinks. If it’s in a subfolder, set RewriteBase and the /api/ paths.
The htaccess.txt in Joomla 6.2, the latest version, is byte-for-byte identical to Joomla 5.4.10’s.
I tested every rule below on a real Joomla 5.4.10 site running on Apache 2.4 (XAMPP 8.2.12), installed in the /j5/ subfolder. I also compared the stock file against the Joomla 6.2.0 package. The images marked “real output” show the actual HTTP responses and log lines. Sources: Joomla’s htaccess.txt guide, Joomla’s SEF troubleshooting page and the Apache mod_rewrite docs.
What is the Joomla .htaccess file and do I need it?
On Apache and LiteSpeed, .htaccess holds per-folder server rules. Joomla’s version does four jobs:
it turns off directory listings
it adds two security headers
it blocks some common exploit query strings
it routes clean SEF URLs to index.php (and /api/ to api/index.php)
You need it if you want URLs without /index.php/. Nginx ignores the file, and IIS uses web.config.txt, which Joomla also ships. As Joomla’s security checklist notes, updates never change your live .htaccess. They only replace htaccess.txt, so after a major upgrade, compare the two files yourself.
What’s in Joomla 6.2’s htaccess.txt?
Section
What it does
Tested result
Options +FollowSymlinks, -Indexes, IndexIgnore *
Lets mod_rewrite work and turns off folder listings
No listings
X-Content-Type-Options "nosniff"
Stops browsers guessing MIME types
Header present
SVG Content-Security-Policy "script-src 'none'"
Blocks scripts when an SVG file is opened directly
RedirectMatch 302 ^/$ /index.php/ when mod_rewrite is missing
Keeps the site usable without rewriting
—
GZIP & Brotli section
Serves pre-compressed .css.gz and .js.gz files and avoids double compression
—
How do I enable .htaccess and remove index.php from Joomla URLs?
Back up any existing .htaccess. Your host may have added rules, such as the PHP version handler.
Copy htaccess.txt to .htaccess in the Joomla root, using the file manager or FTP. Copying keeps the original for later comparison. If a .htaccess already exists, merge the host’s lines into the new file.
Go to System → Global Configuration → Site → SEO Settings, set Search Engine Friendly URLs and Use URL Rewriting to Yes, and save.
Open an inner page. If it loads without /index.php/, it’s working.
The order matters. I turned on URL Rewriting before renaming the file, and every inner URL returned 404. Old /index.php/… links returned a 301 to the clean URL, which Apache then couldn’t serve:
If the file is named correctly and inner pages still 404, Apache is ignoring it. The server needs AllowOverride All (or at least FileInfo Options) for your folder, and mod_rewrite must be loaded. Joomla’s docs suggest a quick test: put only RewriteEngine On and a single redirect rule in the file and see whether the redirect fires.
How do I force HTTPS and www with .htaccess in Joomla?
First, set Global Configuration → Server → Force HTTPS → Entire Site. For a server-level 301, put these lines inside the stock file’s Custom redirects block. That block sits after the exploit rules and before the SEF section, inside <IfModule mod_rewrite.c>:
## Begin - Custom redirects
# Force HTTPS
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
# Force www
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
## End - Custom redirects
To go the other way (www to non-www), use RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC] with RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L].
Behind Cloudflare or a load balancer, Apache sees plain HTTP, and %{HTTPS} off loops forever. Add RewriteCond %{HTTP:X-Forwarded-Proto} !https to the HTTPS rule. Also set Global Configuration → Server → Behind Load Balancer to Yes. Test redirects with a 302 first, because browsers cache 301s.
Which security rules should I add to Joomla’s .htaccess?
Each of these was tested on the site and is written in Apache 2.4 syntax. Many older guides, including Joomla’s own, still show Apache 2.2’s Order Deny,Allow, which only works if mod_access_compat is loaded.
1. Stop PHP running in upload folders
This was the most useful rule in testing. A test images/evil.php ran before and returned 403 after. Put it in images/.htaccess, and also in media/ and tmp/ if no extension needs PHP there:
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
Require all denied
</FilesMatch>
2. Limit /administrator to your IP
# administrator/.htaccess
<RequireAny>
Require ip 203.0.113.10
</RequireAny>
In my test, the allowed IP got 200 and another IP got 403. Only use this if your IP is fixed. Otherwise use Joomla’s Multi-factor Authentication or the Administrator Secret URL feature of a security extension.
3. Hide files that reveal versions or settings
<FilesMatch "\.(ini|log|sql|bak|sh|dist|md)$|^(htaccess\.txt|web\.config\.txt|README\.txt|LICENSE\.txt|configuration\.php-dist)$">
Require all denied
</FilesMatch>
All three test files returned 403, and robots.txt still returned 200. configuration.php is PHP, so the web server doesn’t show its contents. Protect it with file permissions (444 or 440) instead.
Joomla’s System – HTTP Headers plugin is enabled by default. It already sends X-Frame-Options and Referrer-Policy. When I also set them in .htaccess, every response carried each header twice. Configure headers, including HSTS and CSP, in the plugin, or turn the plugin off if you manage them in Apache. Our Joomla security guide covers the rest of the hardening.
Should I add caching and compression to .htaccess?
The stock GZIP section only serves .css.gz and .js.gz files that already exist. It doesn’t compress anything itself. If your host doesn’t already compress responses, add mod_deflate and browser caching:
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/html text/css text/javascript application/javascript application/json image/svg+xml
</IfModule>
<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/webp "access plus 1 year"
ExpiresByType image/png "access plus 1 year"
ExpiresByType image/svg+xml "access plus 1 year"
ExpiresByType font/woff2 "access plus 1 year"
ExpiresByType text/css "access plus 1 month"
ExpiresByType text/javascript "access plus 1 month"
</IfModule>
With these rules, HTML and CSS responses came back with Content-Encoding: gzip, and CSS files returned Cache-Control: max-age=2592000 (30 days). Joomla’s own warning in the file still applies: if you see ERR_CONTENT_DECODING_FAILED or a broken layout, the server is already compressing, so remove one of the two. Don’t also turn on Global Configuration → Server → Gzip Page Compression if the server compresses HTML.
Why does .htaccess cause a 500 Internal Server Error?
Apache refuses to serve any page in a folder whose .htaccess contains an invalid line. A single typo did this on my test site, and the error log named the exact problem:
500 with “Invalid command ‘Header’” or “‘Expires…’”
The module isn’t loaded
Wrap the lines in <IfModule> or ask the host
Home page works, inner pages 404
File not renamed, AllowOverride None, or mod_rewrite off
Rename the file, then check the server config
Subfolder site: inner pages 404
URLs don’t map to file paths (aliases, userdir)
Uncomment RewriteBase /yourfolder
Subfolder site: API returns the front-end 404
Stock rule matches ^/api/ only
Change it to ^/yourfolder/api/
ERR_TOO_MANY_REDIRECTS
HTTPS rule behind a proxy, or Joomla’s Force HTTPS fighting the proxy
Add the X-Forwarded-Proto condition and turn on Behind Load Balancer
Broken CSS or JS, ERR_CONTENT_DECODING_FAILED
Double gzip
Comment out the GZIP section
Changes have no effect on OpenLiteSpeed
Rules are read at startup
Restart the web server, as noted in the file
Read the exact error in your host’s error log, or in logs/error_log on Apache. For a mod_rewrite-specific 500, see our Joomla mod_rewrite 500 fix.
Does .htaccess work for Joomla in a subfolder?
Mostly. With Joomla in /j5/, front-end SEF URLs worked without changing RewriteBase, because the folder maps directly to the URL. The API didn’t work. The stock condition RewriteCond %{REQUEST_URI} ^/api/ never matched /j5/api/…, so API calls went to the front end and returned 404. Changing both API lines fixed it:
Add the HTTPS redirect, headers and caching as Nginx directives, then run nginx -t and reload Nginx.
Frequently asked questions
Where is the .htaccess file in Joomla?
Joomla ships it as htaccess.txt in the site root, next to configuration.php. It only works once you rename or copy it to .htaccess. Turn on “show hidden files” in your file manager to see it.
Is the Joomla 6.2 htaccess.txt different from Joomla 5?
No. The file in the Joomla 6.2.0 package is identical to the one in 5.4.10. When upgrading from 5 to 6, you don’t need to change your .htaccess unless you edited the stock rules.
Does a Joomla update overwrite my .htaccess?
No. Updates only replace htaccess.txt. Your live .htaccess stays as it is, so compare it with the new htaccess.txt after major upgrades.
How do I remove index.php from Joomla URLs?
Rename htaccess.txt to .htaccess first. Then set both Search Engine Friendly URLs and Use URL Rewriting to Yes in Global Configuration → Site.
Why do I get a 500 error after renaming htaccess.txt?
Usually Options +FollowSymlinks isn’t allowed on the host, so comment it out. Otherwise check the error log for an “Invalid command” line naming the bad directive.
Where do I put custom redirects in Joomla’s .htaccess?
Inside the “Begin – Custom redirects” block. It comes after the exploit rules and before the SEF section, so your 301s run before Joomla’s routing.
Can .htaccess make Joomla secure on its own?
No. It blocks some attack patterns and can stop uploaded PHP from running, but updates, file permissions, MFA and backups matter more.
Should I use RewriteBase in Joomla?
Only when URLs don’t map to file paths, for example with aliases or user directories. A normal subfolder install worked without it in my test, but its API rules needed the folder name.
Does Joomla’s .htaccess work on Nginx or IIS?
No. Nginx needs try_files rules in its config, and IIS uses Joomla’s web.config.txt, renamed to web.config. LiteSpeed reads .htaccess, and OpenLiteSpeed needs a restart after changes.
Do I still need .htaccess on Joomla 6?
Yes, on Apache or LiteSpeed, if you want clean URLs without index.php, the exploit filters and the API routing. Joomla 6.2 runs without it, but URLs then include /index.php/.
K2 does not work on Joomla 5 or Joomla 6 because there is no supported K2 release for those versions. If you upgraded first, K2 views fatal, but the data usually still sits in #__k2_* tables. The fix is not “force K2 to load.” The fix is to copy K2 into native Joomla articles on a Joomla 3.10 site with Migrate K2 Pro, then uninstall K2 and climb to Joomla 5 or 6.
That is why so many owners feel stuck on Joomla 3: security pressure goes up, K2 will not follow, and a manual move of thousands of items looks impossible. Migrate K2 Pro (by Infyways Solutions / JoomlaX) is the operator path listed on the Joomla Extensions Directory: one component run for items, categories, tags, extra fields, images, and 301 redirects, with live progress, export, and full rollback.
Two ways to fix it: run the migration yourself with Migrate K2 Pro (steps below), or let us do it: our K2 to Joomla articles migration service moves items, categories, extra fields, images, tags and URLs, then upgrades the site to Joomla 5 or 6.
Why K2 fails on Joomla 5 and 6
K2 was a full content stack on Joomla 3: items, nested categories, extra fields, tags, galleries, attachments, and images under media/k2/. Joomla core later grew custom fields, tags, and nested categories. The K2 project did not ship a supported Joomla 4 / 5 / 6 line.
So in 2026 the failure mode is mechanical:
What you did
What you see
What the data is doing
Still on Joomla 3 with K2
Site works, but you cannot upgrade safely
K2 tables are readable
Upgraded to Joomla 4/5/6 with K2 still installed
White screens, fatal errors, missing menus
Rows often remain in #__k2_* but PHP will not run
Uninstalled K2, then upgraded
404s on old URLs, empty content areas
Content may be gone or orphaned
You cannot “patch K2 to work on Joomla 5.” You migrate off K2 while Joomla 3 can still execute it.
If K2 already broke after a Joomla 5 or 6 upgrade
Do not uninstall K2 on the broken production site until you know the tables and a backup exist.
Take a full backup (files + database) of the broken site.
Restore a Joomla 3.10 copy to staging (from a pre-upgrade backup if that is all you have).
Confirm K2 loads on that Joomla 3 staging copy and item counts look right.
Run Migrate K2 Pro there (next sections).
Only after articles, fields, tags, images, and redirects look correct, plan the upgrade ladder on staging: 3.10 → 4.4 → 5.4 → 6.x as your extensions allow.
If you have no Joomla 3 backup and only a dead Joomla 5/6 site with K2 tables left, stop and get a recovery plan. Exporting raw #__k2_* tables is possible, but rebuilding without a working K2 admin is a service job, not a one-click afternoon.
The wrong fixes people try
Approach
Result
Stay on Joomla 3 forever
Temporary peace, rising security and hosting risk
Hack K2 PHP for Joomla 5
Unsupportable. Breaks again on the next core update
Upgrade first, keep K2
K2 fatals. Content trapped
Uninstall K2, hope articles appear
They do not. URLs and extra fields vanish
Manual SQL copy
Easy to miss images, tags, fields, and redirects
The correct row: copy to com_content on Joomla 3.10, then upgrade.
Migrate K2 Pro: the JED migration fix
Migrate K2 Pro is a professional Joomla 3.10+ component from Infyways Solutions. It reads K2 and writes native Joomla content. It does not delete or rewrite K2 rows. JED summary: items, categories, tags, extra fields, images, URL redirects, live progress, AJAX batches, CSV/JSON/SQL export, full rollback, migration log.
Store listing: joomlax.com/migrate-k2-pro.html (Joomla 3, v1.2.1, 30-day money-back). Requirements from the listing: PHP 7.2+, MySQL 5.6+ / MariaDB 10.1+, K2 installed with data, writable images/, ZipArchive for CSV export.
Custom field groups, fields, and per-article values
Item images, captions, credits
Files under a configurable path (default images/k2-migrated) plus intro/full image JSON
Item URLs
com_redirect 301s for /component/k2/item/{id} and /component/k2/item/{alias}
What it does not turn into core articles
Comments and attachments are available via export (CSV, JSON, SQL), not as core article comments. Author profile pages have no native K2 equivalent. Plan those before you delete K2. Field display chrome after migration is covered in Joomla custom fields.
Operator features that matter on large sites
AJAX batches so 10,000+ items do not time out the browser
Live progress (for example 4,521 / 10,000) with phase steps: Categories → Fields → Tags → Items
Pause / resume and auto-retry on network errors
Idempotent re-runs without duplicate categories
One-click rollback of migrated articles, fields, tags, and MigrateK2-tagged redirects
Dashboard checks: K2 detection, counts, media folder
Step 1: Back up and install on Joomla 3.10
Full backup of the Joomla 3 site (or the restored Joomla 3 staging copy).
Because there is no supported K2 release for those versions. The component’s PHP targets Joomla 3. After an upgrade, K2 views fail even if database tables remain.
What is the easiest migration fix?
Copy K2 into native Joomla articles on Joomla 3.10 with Migrate K2 Pro, verify redirects, uninstall K2, then upgrade. That is the path Infyways documents and ships.
Will I lose my K2 data?
Migrate K2 Pro only reads and copies. It does not modify K2 tables. Always take a full backup first. Rollback removes migrated Joomla content, not original K2 rows.
Can it handle large K2 sites?
Yes. AJAX batch processing, live progress, resume, and auto-retry are built for large libraries (thousands of items). Export first if you want an offline safety copy.
Does Migrate K2 Pro run on Joomla 5?
No. It runs on Joomla 3.10+ where K2 still executes. After migration, the content runs on Joomla 5 and 6 as native articles.
Do I need coding knowledge?
No for a standard K2 site. Install, configure image path, start migration, verify. Custom templates and attachment workflows may need a developer.
