Maintenance and security guidance

Prepare, change, verify, record. No checklist can guarantee a secure website.

Keep a baseline

Maintain a private record of the installed Joomla release, template, extensions, PHP environment and critical integrations. Identify who can authorize changes and who can restore the site. Keep secrets out of shared reports.

Before an update

• Review relevant official and vendor notices.
• Take a files-and-database backup and confirm the recovery method.
• Test impactful changes on a separate copy with real mail and transactions isolated.
• Resolve compatibility warnings before relying on the update.

After a change

Check the actual public journey: menus, important pages, images, search and authorized form tests. Inspect native system status as well as the frontend. Record what was tested and which external services remain unverified. Cache-busted success is not enough; check the normal visitor URL too.

Access and incident awareness

Review staff permissions and use individual accounts and supported multi-factor authentication. If compromise is suspected, preserve evidence and seek authorized specialist assistance rather than overwriting the site repeatedly.

Primary sources: Joomla security guidance, Security Centre and native update procedure.

Read the maintenance routine · Rehearse a backup restoration

Reviewed 4 November 2026. General operational guidance, not a security audit or guarantee.