# Joomla security: the core, the extensions and what nobody checks.

> Joomla 3, 4, 5 and 6 security: core, extensions, Super Users and forgotten backups, reviewed with a read-only plugin. Report from €129, plus cleanup.

URL: https://webintacta.com/en/joomla-security
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** On Joomla, intrusions usually come in through an outdated extension or an unsupported version: Joomla 3 stopped getting patches in August 2023 and Joomla 4 in October 2025. At WebIntacta (Jose Soriano) I review your Joomla from the inside with a read-only plugin, without asking for FTP: core integrity, PHP hidden in images, forgotten backups and extensions with their versions. The external scan is free and the report costs €129, excluding VAT.


Plenty of business websites still run on Joomla, and plenty of them on a version that no longer gets patches. I review your Joomla from the inside, with a read-only plugin you install from the administrator, and tell you what is wrong, what is urgent and what upgrading involves.

## What I check on a Joomla site

- Core version and whether its branch is still supported (3.10, 4.x, 5.x, 6.x)
- Core files compared with the originals of your exact version
- Installed extensions and templates with their versions, matched against published advisories
- PHP hidden in `images/` and `media/`, and `.htaccess` files that let it run
- Forgotten backups: `configuration.php.bak`, `.sql` dumps, `kickstart.php` and Akeeba `.jpa` files
- Error logs, Super User accounts and debug settings

## How I do it

1. **Free external scan.** Joomla version and whether it is supported, published core vulnerabilities, exposed files, HTTPS, headers, email and blacklists.
2. **Read-only plugin.** Installed from System → Install → Extensions, no FTP needed. It only answers requests signed from my panel and you can disable it whenever you like.
3. **Report and plan.** A PDF with the grade, the urgent items first and a concrete action for each finding: update, replace the extension or clean up.

## Joomla security checklist

What I look at first on a Joomla site, and what you can check yourself from the administrator or your hosting's file manager:

1. **A supported version.** Joomla 3 ended in August 2023 and Joomla 4 in October 2025; today Joomla 5 and Joomla 6 get patches. If your site is on 3 or 4, the core is no longer fixed even when a vulnerability is published.
2. **Extensions up to date and from a known source.** In System → Manage → Extensions you can see each one's version. Abandoned extensions, or ones downloaded from sites other than the developer's, are the most common way in.
3. **Super Users accounted for.** In Users, filter by the Super Users group: any account nobody recognizes is a sign of intrusion. Turn on multi-factor authentication, which Joomla ships with since 4.2.
4. **Template overrides.** Whatever is in `templates/<your-template>/html/` survives updates: it is a good place to hide code, and you need to know where every file there comes from.
5. **No installation leftovers or backups.** No `installation/` folder, no `configuration.php.bak`, and no Akeeba Backup archives inside the public site with `kickstart.php` next to them.
6. **Debugging and errors turned off.** In Global Configuration, "Debug System" off and "Error Reporting" set to "None" in production.
7. **`configuration.php` protected**, with read-only permissions, because it stores the database password.

## An example of why the version matters

In February 2023 a flaw was published in Joomla 4.0.0 to 4.2.7 (CVE-2023-23752) that let anyone read the site's configuration through its API without logging in, database password included. It was fixed in 4.2.8, but for months it was exploited at scale against sites that had not updated. It is the usual pattern: the patch exists, the website does not have it.

## If your Joomla site is already hacked

The signs are the same as on any CMS: redirects, Google warnings, indexed spam pages or Super Users nobody created. Start with [how to tell if your website is hacked](https://webintacta.com/en/guides/how-to-tell-if-website-is-hacked) and do not delete anything before making a backup. Cleaning a hacked Joomla costs from €390, with a fixed quote after the scan, because it depends on the extensions and the version; the process is the same as in [hacked website repair](https://webintacta.com/en/hacked-website-repair): backup, cleanup, closing the way in and the Google review.

## Joomla maintenance

I do not have a fixed-price maintenance plan for Joomla: each installation depends heavily on its extensions and on whether it needs a version migration. If you need one, I send you a quote with what it includes and what it costs per month, after the report.

## Price

The report is fully deducted if you order the cleanup within 30 days. The cleanup price is agreed in writing before I start.

### External scan — Free
Security grade and the problems visible from the internet, in a few minutes and with no sign-up.
- Platform and version (WordPress, PrestaShop, WooCommerce, Shopify…)
- Visible plugins and modules with published flaws
- Files that should not be public (backups, .git, configuration files)
- HTTPS, certificate and security headers
- Domain email (SPF, DKIM, DMARC) and blocklists
- AI agent readiness (scored separately)

### Security report · business website — €129 (excluding VAT)
An inside analysis with the read-only connector and a PDF with an action plan.

$129 outside the EU.
- Core integrity: every file compared with the original of your version
- Malware, backdoors and PHP where it does not belong
- Inventory of plugins or modules with versions and known flaws
- Administrator accounts, configuration and permissions
- Full PDF with fixes, plus a diagnosis-only version
- Q&A by email or chat to go through it together

> Fully credited if you hire a cleanup or maintenance within 30 days.

### Cleanup of other CMSs or custom PHP — from €390 (excluding VAT)
Joomla, Drupal, Magento or your own code: a fixed quote after the analysis.

From $390 outside the EU.
- A first analysis to define the scope
- A fixed quote before any work starts

For Joomla sites outside the EU, the report is $129 and the cleanup from $390.

## Frequently asked questions

### Which Joomla versions does the plugin work with?

Joomla 3.10, 4, 5 and 6. If you cannot install extensions (for example, without administrator access), I use a temporary agent uploaded by FTP that expires after 72 hours and deletes itself.

### My site is on Joomla 3 (end of life). Is a security review worth it?

Yes: it is the riskiest case, because the core no longer gets patches. The report tells you what needs protecting now and what migrating to a supported version involves, which is a project and not a simple update.

### Does the plugin read my data or my users' data?

No. It sends versions, file fingerprints and metadata, plus the contents of the files I ask for so I can review them; never the configuration with passwords, nor backups or dumps. It changes nothing and only answers requests signed from my panel.

### How much does it cost to clean a hacked Joomla site?

It costs from €390, excluding VAT, with the price agreed in writing after the scan and before I start.

Hire or ask (email and chat): https://webintacta.com/soporte?lang=en