Private Messages in Joomla

1. The Basics

1.1 What is the Private Messages Component?

The Private Messages component (com_messages) is Joomla's built-in tool for sending short, internal messages between backend users. It has shipped with Joomla core for many years and lives entirely in the administrator area.

What it does in short:

• It lets one backend user send a message (subject plus body) to another backend user.
• It stores each message as one row in the #__messages database table.
• It can email the recipient when a new message arrives.
• It is also the channel Joomla itself uses to notify Super Users about important events.

Think of it as a tiny internal mailbox. It is not a frontend chat, not a contact form, and not a newsletter tool. It is a quiet, administrator-to-administrator note system.

1.2 Who Can Receive a Message?

This is the single most important fact about Private Messages: you can only send a message to a user who is allowed to log in to the backend. A normal frontend-only registered user cannot receive a private message, because they have no backend inbox to read it in.

Joomla checks two things about the recipient before it sends:

• The recipient must be able to log in to the administrator (core.login.admin).
• The recipient must have the Manage permission on com_messages (core.manage).

In practice this means Managers, Administrators, and Super Users can exchange messages. Authors and registered visitors cannot.

1.3 Where Do I Find It?

In the Joomla 6 backend the menu path is:

Users → Private Messages

Under that menu you will find three actions:

The component lives at administrator/components/com_messages/. There is no frontend folder - by design. It is a backend-only tool.

3. The Inbox: List, Filters, and Actions

3.1 The List Columns

The inbox list (Read Private Messages) shows the messages where you are the recipient. It never shows messages you sent to other people. The columns are:

3.2 Filtering and Searching

Above the list you get a search box and a status filter:

• The search box looks in both the subject and the message body.
• The status filter lets you show only read or only unread messages.

You can also change the sort order by clicking a column header.

3.3 Marking and Deleting

Select one or more rows with the checkboxes, then use the toolbar to mark them read or unread, or to delete them. Deletion is permanent - there is no trash or restore for private messages. Note that you can only mark or delete messages in your own inbox; the component will not let you touch a message addressed to someone else.

5. Email Notifications

5.1 When an Email is Sent

When you send a private message, Joomla decides whether to email the recipient based on their mail_on_new setting, not yours. If the recipient has email notifications switched on (the default), they get an email. If they switched it off, the message is still stored in their inbox - it just arrives silently.

The email is sent in the recipient's backend language and contains the subject and a plain-text version of the message body, plus a link back to the message in the administrator area. The reply-to address is set to the sender, so a direct email reply reaches the right person.

5.2 The Mail Template

The notification uses Joomla's Mail Templates system. The template key is com_messages.new_message. You can customise the wording at System → Templates → Mail Templates by editing that template. The available placeholders include the subject, the message body, the sender name, the site name, and the site URL.

5.3 What if Email Fails?

If your site cannot send email - mail is disabled, or the mail server rejects the message - Joomla does not lose the private message. It still stores the message in the inbox and only logs a warning that the notification email could not be delivered. The recipient will still see the message the next time they open their inbox.

7. Under the Hood: The Database

7.1 The #__messages Table

Every private message is one row in the #__messages table. The columns are:

Two details are worth knowing. First, the priority column exists in the database, but the standard compose form does not let you set it - so in practice every message you send by hand has priority 0. It mainly surfaces through the REST API. Second, "read" and "unread" are just the value of the state column, which the code also exposes under the alias published.

7.2 The #__messages_cfg Table

Your personal settings from section 4 are not stored in the messages table. They live in a separate key/value table called #__messages_cfg:

Each option is one row. When you save your settings, Joomla deletes your existing rows and writes a fresh row per option. This is why a brand-new user has no rows here at all and simply uses the defaults.

7.3 The Indexes

Both tables carry an index that tells you how Joomla actually reads them.

On a one-person site neither index matters. On a busy multi-editor backend with thousands of stored messages, the useridto_state index is what keeps the inbox responsive.

7.4 A Note on Privacy and Security

Private Messages are "private" only in the sense that other backend users cannot read each other's inboxes through the interface. They are not encrypted. Each message sits as plain text in the #__messages table, which means:

• Anyone with database access (a hosting admin, a DBA, a Super User running a query) can read every message.
• Messages are included in your normal database backups, in plain text.
• The notification email also carries a plain-text copy of the body.

So treat the component as a place for internal notes, not a vault. Never send passwords, API keys, or other secrets through a private message. If you need to share a credential, use a dedicated secrets tool and send only a reference through Joomla.

9. The Web Services API

Unlike some small core components, Private Messages does expose a REST API. The Web Services plugin for messages registers a standard set of CRUD routes under:

/api/index.php/v1/messages

9.1 Listing and Reading

To list the messages in your inbox, send an authenticated GET request with an API token:

curl -H "X-Joomla-Token: <token>" \
     https://example.test/api/index.php/v1/messages

To read a single message, append its id:

curl -H "X-Joomla-Token: <token>" \
     https://example.test/api/index.php/v1/messages/42

Each item returns the fields id, user_id_from, user_id_to, date_time, priority, subject, message, state, and the sender's display name. Note that the API renames the message_id column to id in its output.

9.2 Creating a Message

To send a new message, POST a JSON body:

curl -X POST \
     -H "X-Joomla-Token: <token>" \
     -H "Content-Type: application/json" \
     -d '{"user_id_to": 200, "subject": "Deploy done", "message": "Release 2.4 is live."}' \
     https://example.test/api/index.php/v1/messages

Because the API uses the same model as the backend, the same rules apply: the recipient must be a backend user, and their locked-inbox and email-notification settings are respected. The REST route is the only standard way to set a non-zero priority on a message.

11. SEO and Metadata

This section is short for a good reason: Private Messages has no SEO footprint at all. The component is backend-only, so:

• There are no frontend URLs, no menu item types, and no public pages to index.
• There are no metadata, slugs, or canonical tags to manage.
• Search engines never see message content, which is exactly what you want for private internal notes.

If you are looking for the component when planning your site structure, the practical takeaway is that it needs zero SEO configuration. Spend that attention on your articles, categories, and menus instead.

13. Best Practices

If you only remember a few things from this article, remember these:

• Private Messages is a backend-only mailbox. It reaches Managers, Administrators, and Super Users - never frontend visitors.
• A user must have backend login and Manage on com_messages to receive a message.
• Auto-purge defaults to 7 days and ignores read state. Raise it or set it to 0 if you need to keep notices.
• Do not lock a Super User's inbox on a production site - you will miss Joomla's own system notifications.
• The email notification depends on the recipient's setting, not the sender's.
• Messages are stored as plain text, not encrypted. Never send passwords or secrets through a private message.
• There is no Sent folder and no trash. Deletion is permanent.
• Developers can send messages through the Message model or the REST endpoint at /api/index.php/v1/messages.

15. Summary

Joomla's Private Messages component is a small, backend-only mailbox that quietly connects your administrators. Two database tables hold everything: #__messages for the notes and #__messages_cfg for each user's preferences. One compose form, one inbox, and three personal settings cover the whole feature.

• It only works between backend users with the right permissions.
• It can email recipients, using a mail template you can edit.
• Joomla itself uses it to deliver system notices to Super Users.
• Auto-purge keeps inboxes tidy, and a REST API exposes it to scripts.

Most sites can leave Private Messages on its sensible defaults and never think about it. But if your team relies on backend notifications - update alerts, deploy notices, or simple internal notes - it pays to understand how delivery, locking, and auto-purge interact. If you suspect your administrators are missing important Joomla notices, or you want to wire your own extension into this internal mailbox, that is exactly the kind of detail worth checking before it causes a surprise.