Extensions in Joomla

1. The Basics

1.1 What "Extension" Actually Means

Almost everything in the Joomla backend is an extension, and so is most of what you install from elsewhere. A simple test works well:

If you can install it, enable it, or uninstall it, then it is an extension.

Joomla is the platform. Extensions are everything you bolt onto it. The core CMS provides the framework, the application, and the shared libraries. Every functional thing on a page is delivered through an extension that the installer manages.

            +--------------------------------------+
            |          JOOMLA CORE (CMS)           |
            |   framework . application . libraries|
            +--------------------------------------+
                              ^
            installed & managed | through one pipeline
                              |
   +----------+----------+----+-----+-----------+-----------+
   | Component|  Module  |  Plugin  | Template  | Language  |  ...packages
   |  com_    |  mod_    |  plg_    |  tpl_     |   xx-XX   |   pkg_, lib_, file
   +----------+----------+----------+-----------+-----------+

1.2 The Five Functional Types

These five are the extension types that do something visible on a page. You have probably met each of them already:

But the extension family is bigger than five. The rest are about packaging and support.

1.3 The Full Taxonomy

Joomla's installer recognises more type values than just the visible five. The extra ones are the "glue" that helps you ship and reuse code:

A real-world product, such as a forum or a webshop, usually ships as one pkg_ package that contains a component, several plugins, and a few modules.

1.4 You Already Run Dozens of Extensions

A brand-new Joomla 6 install ships with around 150 extensions out of the box. Open System → Manage → Extensions and you will see them all: components like com_content, every core plugin, both default templates, the English language pack, and the libraries underneath.

There is no "core versus extensions" wall. Core Joomla is delivered as extensions. They are simply marked protected, so you cannot remove them by accident.

On top of the core set, the Joomla Extensions Directory (JED) lists thousands of third-party extensions you can add. Well-known examples include Akeeba Backup for backups, the Regular Labs content tools, and JCE for a richer editor.

3. The Manifest: The Heart of Every Extension

3.1 The Self-describing XML File

Every extension contains one manifest: an XML file that tells Joomla everything about it. The installer reads nothing else first. Hand Joomla a zip with a manifest, and it knows how to install the extension, where its files go, what database tables to create, and how to update it later.

<extension type="component" method="upgrade">
    <name>com_example</name>
    <version>1.0.0</version>
    <creationDate>2026-06-01</creationDate>
    <author>Peter Martin</author>
    <namespace path="src">Joomla\Component\Example</namespace>

    <files folder="site">...</files>            <!-- which files to copy -->
    <media destination="com_example">...</media> <!-- images, css, js -->
    <languages>...</languages>                   <!-- translation files -->

    <install><sql>...</sql></install>            <!-- run on install -->
    <update><schemas>...</schemas></update>       <!-- run on update -->
    <uninstall><sql>...</sql></uninstall>        <!-- run on remove -->

    <scriptfile>script.php</scriptfile>         <!-- custom install logic -->
    <updateservers>...</updateservers>           <!-- where updates live -->
    <config>...</config>                         <!-- the Options form -->
</extension>

One file drives install, update, uninstall, configuration, and updates. Change the type attribute and the same structure describes a module, plugin, template, or package.

3.2 The Attributes That Change Everything

A few attributes on the root <extension> element decide how the installer behaves:

method="upgrade" is why re-installing the same zip updates in place instead of failing with an "already installed" error.

3.3 The Install Script: Custom Logic

For anything the manifest's declarative tags cannot express, an extension can ship a script file with up to five methods:

class com_exampleInstallerScript
{
    public function preflight($type, $parent)  { /* before files are copied */ }
    public function install($parent)           { /* fresh install only      */ }
    public function update($parent)            { /* update only             */ }
    public function uninstall($parent)         { /* on removal              */ }
    public function postflight($type, $parent) { /* after files are copied   */ }
}

Use preflight to block installation on an unsupported PHP or Joomla version by returning false.

3.4 Installer Events: Plugins That Hook Install and Update

The script file affects only its own extension. But the installer also fires events that any enabled plugin can listen to. This lets a plugin react when something else is installed, updated, or removed.

// A commercial vendor's plugin injects its subscription key into the download URL:
public function onInstallerBeforePackageDownload(&$url, &$headers)
{
    if (str_contains($url, 'example.org')) {
        $url .= '&key=' . $this->params->get('download_key');
    }
}

This is exactly how paid extensions add a download or subscription key at update time: an ordinary installer plugin listening to these events, with no change to com_installer.

5. The Update System

5.1 Update Sites: How Joomla Knows an Update Exists

Each extension can register one or more update sites: URLs that Joomla polls to ask "is there a newer version?". They live in #__update_sites, linked to extensions through #__update_sites_extensions.

#__extensions --< #__update_sites_extensions >-- #__update_sites
   (com_example)                                  (https://.../update.xml)

The update site is declared in the manifest:

<updateservers>
    <server type="extension" name="Example Updates">
        https://example.org/updates/com_example.xml
    </server>
</updateservers>

No update site means Joomla can never offer an update for that extension. This is why some manually-installed extensions never show an update notice.

5.2 The Update Server XML

The URL points to an XML file the vendor hosts. There are two flavours:

<updates>
    <update>
        <name>com_example</name>
        <version>1.1.0</version>
        <infourl>https://example.org/changelog</infourl>
        <downloads>
            <downloadurl type="full" format="zip">
                https://example.org/dl/com_example-1.1.0.zip
            </downloadurl>
        </downloads>
        <targetplatform name="joomla" version="6.[01]" />
        <php_minimum>8.1</php_minimum>
    </update>
</updates>

Collection update manifest example
A collection manifest contains references to one or more extension update manifests. Each extension listed in the collection has its own extension update manifest.

<?xml version="1.0" encoding="utf-8"?>
  <extensionset name="Example Extensions">
    <extension>
      <name>com_example</name>
      <updateservers>
         <server type="extension" priority="1" name="com_example"> 
         https://example.org/updates/com_example.xml 
         </server> 
      </updateservers> 
    </extension>

    <extension>
      <name>com_another_example</name>
      <updateservers>
         <server type="extension" priority="1" name="com_another_example">
         https://example.org/updates/com_another_example.xml 
         </server> 
      </updateservers> 
    </extension> 
</extensionset>

The targetplatform and php_minimum elements allow a vendor to provide different update packages for specific Joomla or PHP versions from the same update site.

5.3 The Update Flow

Cron / page load / "Check for updates"
   |
   v
Joomla fetches each update site's XML
   |
   v
Compares the advertised <version> with the installed version
   |
   v
Newer? → row in #__updates  → shown under Update → Extensions
   |
   v
You click Update → Joomla downloads the <downloadurl> zip
   |
   v
...and runs the exact same install pipeline (method="upgrade")

An update is simply an install of a newer zip over the top: the same manifest, the same SQL-update step, the same rollback safety.

5.4 Joomla! Update versus Extension Updates

These are two separate things, and people often confuse them:

Keep both current. A modern, patched core with an outdated, vulnerable extension is still a vulnerable site.

7. Managing and Securing Extensions

7.1 The Manage Screen: Your Control Panel

System → Manage → Extensions lists every row in #__extensions:

protected and locked are why you cannot cripple your site by accident, for example by disabling com_content or removing the default language.

7.2 The Warnings Tab

Manage → Warnings surfaces environment problems the installer detected: missing PHP extensions, unwritable folders, or leftover files from a failed install. Check it when an install "succeeded" but the extension misbehaves.

7.3 Security: The Part That Bites People

Extensions run with full access to your site. A malicious or abandoned extension is the most common way Joomla sites get compromised.

The Joomla CMS core has a strong security track record. The weak link is almost always a third-party extension that was not updated.

7.4 Picking the Right Type to Build

When you need to extend Joomla yourself, choose the type by the job:

The honest first question is often "do I even need a new extension?". A template override, a custom field, or a language override solves many needs with zero code to maintain.

9. Common Mistakes and Pitfalls

9.1 Disabling Instead of Uninstalling

Disabling an extension stops it from running, but the code stays on disk and in the database. For security, that is not enough. If you no longer use an extension, uninstall it so its files and tables are removed.

9.2 Forgetting the Update Site

If you install an extension manually and it never shows an update notice, it probably has no update site registered. Check System → Update → Update Sites. An extension without an update site will silently stay on its old version.

9.3 Ignoring the Schema Warning

A "Database schema is out of date" warning is not cosmetic. It means an SQL migration did not run, often after a manual file update or an interrupted update. Go to Manage → Database and click Fix before strange bugs appear.

9.4 Installing from Untrusted Sources

"Nulled" or pirated copies of commercial extensions are a leading source of malware. The money you save is small compared to the cost of a hacked site. Always download from the developer or the JED.

9.5 Updating the Core but Not the Extensions

Many site owners run Joomla! Update faithfully but forget that extensions update separately. A patched core does not protect you from a vulnerable add-on. Check System → Update → Extensions as well.

9.6 Copying Files Without Discover

Uploading an extension's folder by FTP does not install it. Joomla only "knows" an extension when it has a #__extensions row. After uploading files, run Manage → Discover to register them, or simply install the zip the normal way.

11. Quick Reference

INSTALL      System → Install → Extensions (Upload / Folder / URL / Web)
MANAGE       System → Manage → Extensions (enable / disable / uninstall)
UPDATE       System → Update → Extensions
CORE UPDATE  System → Update → Joomla (separate from extensions)
DISCOVER     Manage → Discover  (register files already on disk)
SCHEMA FIX   Manage → Database  (replay missing SQL)
WARNINGS     Manage → Warnings  (environment problems)
REGISTRY     Every extension = one row in #__extensions
UNIQUE BY    type + element + folder + client_id
OPTIONS      Stored as JSON in #__extensions.params