Joomla explained

2. A Short History and the Version Cycle

2.1 Where Joomla Comes From

Joomla started in 2005 as a fork of an older CMS called Mambo. The name comes from the Swahili word Jumla, which means "all together". That idea still fits: Joomla brings many parts together into one system.

2.2 Major Versions

Joomla moves forward in major releases. Each major version may change how extensions and templates work:

2.3 Why Versions Matter

Two practical rules follow from the version cycle:

• Keep your site on a supported version. Old versions stop receiving security fixes.
• Plan for major upgrades in advance, because some extensions need an update to keep working.

Minor updates (for example 6.0 to 6.1) are usually safe and quick. Major upgrades need a test run on a copy of your site first.

4. Installing Joomla

4.1 What You Need

Joomla runs on a normal web server. The typical requirements are:

• A web server: Apache, NGINX or OpenLiteSpeed
• PHP in a supported version (Joomla 6 uses a recent PHP release).
• A database: MySQL, MariaDB or PostgreSQL.
• HTTPS, so that the website traffic of visitors and logins is encrypted.

This combination is often called a LAMP stack (Linux, Apache, MySQL, PHP).

4.2 The Installation Steps

A fresh install follows a short, guided process:

1. Download Joomla and upload the files to your server.
2. Create an empty database and a database user.
3. Open the site in your browser to start the web installer.
4. Enter the site name, the admin account, and the database details.
5. Joomla creates the tables and finishes the setup.

After install, Joomla asks you to delete the installation folder. This is a safety step, so nobody can run the installer again.

4.3 Sample Data

During install you can load sample data. This fills the site with example articles, menus, and modules. It is a good way to learn, because you can see how a working site is wired together. On a real project, install a blank site instead.

6. The Frontend and Templates

6.1 What a Template Does

A template controls the look of your site: colours, fonts, spacing, and where each block goes. The same content can look completely different under two templates, because the content and the design are kept separate.

6.2 Module Positions

Templates define named module positions, such as sidebar-right or top-a. You then assign modules to these positions. This is how you decide, for example, that the login box appears top right and the menu appears on the left.

Template position "menu"     → Main Menu module
Template position "sidebar"  → Latest Articles module
Template position "footer"   → Copyright module

6.3 Site and Administrator Templates

Joomla has separate templates for the two sides of the site:

• A site template for the public frontend.
• An administrator template for the backend.

You can install several templates and switch the active one, or assign a different template to specific menu items.

6.4 Overrides

Templates can include overrides: copies of Joomla's default layout files placed inside the template. Overrides let you change how a component looks without editing Joomla's core files, so your changes survive updates. We return to this in the developer section.

8. Users, Groups, and Access Control

8.1 The Three ACL Concepts

Joomla has a powerful Access Control List (ACL) system. It is built from three ideas that work together:

8.2 Default User Groups

Joomla ships with a ready-made set of groups, arranged as a tree. Each group inherits from its parent:

Public
 +-- Registered
 |    +-- Author
 |         +-- Editor
 |              +-- Publisher
 +-- Manager
      +-- Administrator
           +-- Super Users

A Super User can do everything. A Registered user can only see content reserved for logged-in visitors. You can add your own groups for any situation, such as "Paid Members" or "Staff".

8.3 Permissions Inherit From the Top

Permissions flow downward, from global settings to the single item:

Global Configuration
   +-- Component (for example com_content)
         +-- Category
               +-- Article

At each level a permission can be Inherit, Allowed, or Denied. A "Denied" high up cannot be overridden lower down. A useful rule: deny at the highest level you can, allow at the lowest level you must.

10. Under the Hood (Developer View)

10.1 The Directory Layout

A Joomla install has a clear folder structure. The most important folders are:

administrator/   the backend application and admin parts of components
api/             the Web Services (REST) application
components/      the frontend part of each component
modules/         site modules
plugins/         all plugins, grouped by type
templates/       site templates
libraries/       the Joomla and Framework core code
language/        installed language packs
media/           public CSS, JavaScript, and images
images/          your uploaded media
cache/, tmp/, logs/   working folders

10.2 The Database

Joomla stores almost everything in the database. Table names use a configurable prefix, written as #__ in code (for example #__content for articles). The prefix lets several Joomla sites share one database safely.

A few core tables show the pattern:

The #__assets table is the quiet engine of Joomla's access control. Every component, category, and article has a matching asset row that stores its permission rules as JSON, arranged as a nested tree so permissions can inherit from parent to child. When ACL "does not behave", the cause is almost always here.

10.3 The MVC Pattern

Joomla components follow the Model-View-Controller (MVC) pattern. This separates the work into three roles:

• The Model talks to the database and holds the data.
• The View turns that data into HTML, JSON, or another format.
• The Controller reacts to the request and ties the two together.

Modern Joomla code is fully namespaced and uses a factory to load components. A typical example:

use Joomla\CMS\Factory;

$app     = Factory::getApplication();
$factory = $app->bootComponent('com_content')->getMVCFactory();
$model   = $factory->createModel('Articles', 'Site', ['ignore_request' => true]);
$items   = $model->getItems();

10.4 Service Providers and Dependency Injection

Modern Joomla extensions no longer rely on global access to build their objects. Each extension ships a service provider that registers its classes in a Dependency Injection (DI) container. Joomla then asks the container for what it needs, and the container wires the parts together.

For a component the entry point is one file:

com_example/
   services/
      provider.php      registers the component in the DI container
   src/
      Controller/
      Model/
      View/

The benefit is cleaner, testable code: classes declare what they depend on instead of reaching out for it. This is also why modern Joomla code follows PSR standards and can use Composer for third-party libraries.

10.5 The Database Abstraction Layer

Developers rarely write raw SQL strings in Joomla. Instead they use the Database Abstraction Layer and its query builder, which produces safe, portable queries:

$db    = $this->getDatabase();
$query = $db->getQuery(true)
    ->select($db->quoteName(['id', 'title']))
    ->from($db->quoteName('#__content'))
    ->where($db->quoteName('state') . ' = :state')
    ->bind(':state', 1, ParameterType::INTEGER);

$db->setQuery($query);
$rows = $db->loadObjectList();

The query builder quotes names, binds parameters, and adapts to the database in use. This prevents SQL injection and keeps the same code working on MySQL and MariaDB.

10.6 Events and Plugins

Joomla uses an event system driven by an event dispatcher. At key moments it fires an event, and plugins listen for it. For example, onContentPrepare fires before content is shown, so a plugin can change the text. This is how Joomla stays flexible without anyone editing the core.

10.7 Performance and Caching

Joomla can cache rendered output to make pages faster. It offers page cache, view cache, and module cache. Remember to clear the cache after you change content or settings.

On busy sites you combine Joomla's own cache with server-level tuning:

• OPcache: a PHP setting that keeps compiled code in memory, so PHP does not recompile on every request.
• Redis or Memcached: fast in-memory storage that Joomla can use for its cache and sessions instead of files.
• A CDN: serves images, CSS, and JavaScript from servers close to the visitor.
• Image optimization: smaller images mean faster pages and better scores.
• Database indexing: on large sites, good indexes keep queries fast.

12. Security and Maintenance

12.1 Updates Are Your First Defence

The single most important security task is to keep Joomla and all extensions up to date. Most hacked Joomla sites run outdated software with known holes. Joomla shows updates on the dashboard and can update itself with one click.

12.2 A Simple Maintenance Routine

12.3 Backups

A backup is a full copy of your files and database that you can restore after a problem. Always test that a backup actually restores; an untested backup is not a backup. Keep at least one copy at another location off the server.

12.4 Extra Protection

• Use strong passwords and enable two-factor authentication for backend users.
• Serve the whole site over HTTPS.
• Add security headers (Joomla has a built-in HTTP Headers plugin).
• Remove extensions you no longer use; unused code is still a risk.

12.5 What Joomla Protects You With by Default

A lot of security is already built into the core, so well-written extensions get it for free:

The key point for developers: use Joomla's input, form, and database tools. They apply these protections automatically. Hand-written shortcuts around them are where most extension vulnerabilities come from.

14. Common Mistakes and Pitfalls

14.1 Treating Joomla Like a Static Site

Symptom: an editor tries to build every page as one long article and pastes raw HTML for layout.

Fix: use menus, categories, and modules. Let Joomla assemble pages so the design stays consistent and easy to change.

14.2 Skipping Updates

Symptom: the site runs an old version for years, then gets hacked or breaks on a server upgrade.

Fix: update on a schedule. Test major upgrades on a copy first, then apply them to the live site.

14.3 Editing Core Files

Symptom: someone changes a Joomla core file to tweak a layout (called "core hack"), and the next update wipes the change.

Fix: use template overrides and plugins. Never edit core files directly.

14.4 Installing Too Many Extensions

Symptom: the site is slow, and every update is risky because dozens of add-ons might break.

Fix: use the core where you can. Each extra extension is more code to trust, update, and secure.

14.5 No Backup Before Changes

Symptom: an update or edit goes wrong and there is no way back.

Fix: take a tested backup before every update or large change.

16. Quick Reference

BACKEND       https://yoursite/administrator
NEW ARTICLE   Content → Articles → New
NEW MENU      Menus → Manage → Add Menu
ADD MODULE    System → Site Modules → New
INSTALL EXT   System → Install → Extensions
USERS & ACL   Users → Manage / Groups / Access Levels
TEMPLATE      System → Site Templates
SEF URLS      System → Global Configuration → Site
UPDATES       System → Update → Joomla / Extensions
API           /api/index.php/v1/...  with X-Joomla-Token
CLI           php cli/joomla.php <command>