Extensions are a big part of what makes Joomla useful. They add forms, galleries, shops, booking tools and much more. They are also written by many different developers, and quality varies. A few minutes of checking before you install one can save a lot of cleanup later.
The Joomla project publishes guidance on this in its security checklist. The Joomla Extensions Directory also keeps a list of extensions with known security problems. Both are free to use and worth checking every time. Here is how to put them to work on your own site.
Why extensions need a closer look
Every extension adds code to your site, and that code runs alongside Joomla itself. The Joomla security checklist notes that third party developers are not required to follow Joomla coding standards. It also warns that extensions vary in quality. A poorly written extension can slow a site, clash with others or open a security hole.
This matters whatever type of site you run. A brochure site, a directory and an online shop all rely on extensions in different ways. Our overview of website types a web designer can create shows how varied those needs can be. The more extensions a site uses, the more care each new one deserves.
Check the Vulnerable Extensions List first
The Joomla Vulnerable Extensions List is part of the Joomla Extensions Directory. It tracks third party extensions with known security issues. Live entries show the extension name, the affected version and the type of problem, such as SQL injection or cross site scripting. A separate resolved section lists extensions where a patch is available.
The advice on the list is simple. If an extension is listed as vulnerable with no patch available, uninstall it. If it appears in the resolved section and your site uses it, update it. For any other security questions, check with the publisher.
The list is honest about its limits. It states that it is compiled from found information and may not be an up to date accurate list. It also says reports are not tested or validated by the team. Treat a clean result as a good sign rather than a guarantee.
Look at the extension itself
The Joomla security checklist advises reviewing code quality before you install. You may not read PHP, but you can still check a few signs. Look at when the extension was last updated and whether it supports your version of Joomla. Read the developer’s documentation and see whether support questions get answered.
It also helps to search the Joomla forums. The checklist suggests searching forums for incompatible extensions before you upgrade Joomla. The same habit works well before a new install. Other users often report clashes and fixes there first.
Quick checks before you click install
- Search the Vulnerable Extensions List for the extension name.
- Confirm it supports your current Joomla version.
- Check when it was last updated.
- Read the documentation and support pages.
- Ask whether an extension you already have does the same job.
Choosing between similar extensions
Popular jobs such as contact forms or image galleries often have several extensions competing for the same role. Compare them on the same checks rather than on screenshots alone. A smaller extension that does one job well is often easier to keep updated than a large one packed with features you will never use. Fewer features also mean less code sitting on your site.
Look at what each option asks of your template too. Some extensions bring their own styles that may not match your design. Others let you change their output with template overrides, which keeps the look consistent with the rest of the site. Try your shortlist on a test copy and keep the one that fits with the least fuss.
Back up and test before going live
The security checklist is clear on backups. It says to always back up your site’s files and database before installing extensions. It also recommends an automated backup script so you can return the site to a previous working state. A backup turns a failed install into a short delay rather than a crisis.
The checklist also says to test all extensions on a development site before installing them on a production site. A test copy shows how the extension behaves with your template and other extensions. Our guide to choosing Joomla hosting over regular hosting explains what to look for in a host that suits this kind of work. Check the front end on a phone and a desktop before you go live.
You do not need to be a developer to follow these steps. Taking a backup and installing on a test copy are routine tasks. If you are unsure how much skill your setup needs, our piece on technical expertise for Joomla hosting covers the basics. The aim is a routine you can repeat every time.
Keep installed extensions in good shape
Checking does not stop once the extension is live. The checklist recommends keeping an eye on the Vulnerable Extensions List, so come back to it from time to time. Apply updates from the developer when they appear, after trying them on your test copy. An extension that stops getting updates is a sign to look for a replacement.
Remove what you no longer use. The checklist advises removing unused extensions and checking that uninstall scripts actually removed their files. It warns that leftover files remain accessible from the web via direct URLs. A tidy site with fewer extensions is easier to look after.
If the list of extensions grows beyond what you can manage, outside help can make sense. A good designer can review what you have and trim what you do not need. Our tips on finding the best web design services can help you pick someone suitable. Ask them to explain each extension they keep and why.
Frequently asked questions
Is an extension safe if it is not on the Vulnerable Extensions List?
Not necessarily. The list says it may not be up to date and that reports are not tested or validated. Use it as one check among several, alongside backups and testing.
What should I do if an extension I use appears on the list?
If it sits in the resolved section, the list advises updating it. If it is listed as vulnerable with no patch, the advice is to uninstall it. Take a backup first, then check your site still works after the change.
Is it fine to install an extension straight onto my live site?
The Joomla security checklist advises against it. It says to test all extensions on a development site before installing them on a production site. It also says to back up your files and database first.
Does uninstalling an extension remove everything?
Not always. The Joomla security checklist advises checking that uninstall scripts actually removed the extension’s files. Leftover files can still be reached on the web through direct URLs.