Joomla

Joomla!
Status	🤝 Community
Type	Content Management System (CMS)
License	GPL v2 or later
Language	PHP
Database	MySQL / MariaDB / PostgreSQL
Latest Version	5.1
Release Date	September 22, 2005
Website	Official Site
GitHub	Repository

🤝 Community Page — This page is maintained by the ZelocoreCMS community. Information may not reflect the latest official details. If you are the official CMS owner, claim your page to manage it officially.

Joomla! (often stylized as Joomla) is a free and open-source content management system (CMS) written in PHP and paired with a database engine such as MySQL, MariaDB, or PostgreSQL. Built on a model–view–controller (MVC) web application framework, Joomla can be used independently of the CMS to build powerful online applications. Joomla is maintained by a global community of volunteers and supported legally and financially by Open Source Matters, Inc.

As one of the most widely adopted open-source content management systems in web history, Joomla occupies a strategic middle ground between the user-friendly simplicity of WordPress and the high technical complexity of Drupal. It offers out-of-the-box native support for multilingual websites, advanced role-based access control (ACL), content workflows, and custom field structures without requiring third-party extensions.

Overview

Joomla is designed to power a wide variety of web publishing applications, ranging from small business websites and personal blogs to enterprise corporate portals, intranets, e-commerce stores, and community networks. Its architecture balances accessibility for non-technical content editors with structural modularity for developers and web architects.

Unlike basic blogging engines, Joomla organizes content using a structured paradigm composed of Articles, Categories, Tags, and custom Fields. Content elements can be assigned to hierarchical multi-level category trees and presented across flexible front-end menu structures. Joomla's native routing engine allows site administrators to map specific menu items directly to component views, modules, or external application endpoints.

Key capabilities of Joomla include:

Native Multilingual Support: Core support for translating articles, menu systems, modules, and administrative interfaces into over 70 languages natively.
Granular Access Control (ACL): Comprehensive access control management allowing administrators to define precise permissions for viewing, creating, editing, and deleting content at global, component, category, or article levels.
Modular Extension System: A multi-tiered architecture divided into Components, Modules, Plugins, Templates, and Languages.
Headless Capabilities: Integrated OpenAPI-compliant JSON REST Web Services for headless CMS deployments and front-end framework integration.

History

Joomla was created as a result of a fork of the Mambo CMS on August 17, 2005. At the time, the core development team of Mambo parted ways with Miro International Pty Ltd, which owned the Mambo trademark, due to disagreements regarding the governance and commercial steering of the open-source project.

The development community established a non-profit organization named Open Source Matters, Inc. (OSM) to manage the project's legal, financial, and organizational assets. The community held a name selection process, resulting in the choice of "Joomla!", which is derived from the Swahili word jumla, meaning "all together" or "as a whole."

Major Release Timeline

2005 (Joomla 1.0): Released on September 22, 2005, as a re-branded and patch-secured fork of Mambo 4.5.2.8.
2008 (Joomla 1.5): A major ground-up refactoring that introduced modern PHP 5 object-oriented programming concepts, UTF-8 internationalization, a dedicated template override system, and the decoupled Joomla Framework (JFramework).
2011 (Joomla 1.6 & 1.7): Introduced an upgraded Access Control List (ACL) system, unlimited nested category hierarchies, redirect management, and automated extension update notifications.
2012 (Joomla 2.5): Established a long-term support (LTS) release cycle, introducing multi-database abstraction (support for PostgreSQL and Microsoft SQL Server), native search engine components, and automatic background updates.
2012–2014 (Joomla 3.0 – 3.4): A landmark generation that introduced a mobile-responsive user interface for both the front-end and back-end administrative dashboard using the Bootstrap framework. Subsequent point releases added two-factor authentication (2FA), microdata structured data insertion, and tag management.
2021 (Joomla 4.0): A comprehensive modern architectural overhaul featuring a rewritten codebase built on PHP 7.2+, Bootstrap 5, native Web Services REST API, workflow management engines, a revamped Media Manager with image manipulation, enhanced WCAG 2.1 AA accessibility compliance, and strict code optimization.
2023–2024 (Joomla 5.0 & 5.1): Released with native support for PHP 8.2+, removal of legacy backward-compatibility code paths, dark mode administrative theme enhancement, native Schema.org integration, Font Awesome 6 support, asset pipeline performance improvements, and automated database schema validation.

Key Features

Native Multilingual Management

Unlike many other CMS platforms that require external paid plugins or complex third-party extensions to serve multilingual content, Joomla provides built-in internationalization. Site administrators can install language packs, enable language filter plugins, assign content items and menu entries to specific languages, and associate equivalent pages across multiple languages for seamless language switching.

Advanced Access Control List (ACL)

Joomla features one of the most flexible native Access Control List systems among open-source CMS platforms. It distinguishes between User Groups (defining what actions users can perform, such as Create, Delete, Edit, Edit State, Edit Own) and Viewing Access Levels (defining what content items, menu items, or modules users can see). Permissions inherit down category trees and can be customized per component, category, or individual item.

Integrated Content Workflows

Introduced in Joomla 4, the native Workflow component replaces basic binary state management (Published / Unpublished) with customizable execution pipelines. Organizations can establish multi-step review stages (e.g., Draft $\rightarrow$ Editorial Review $\rightarrow$ Legal Approval $\rightarrow$ Published) and assign specific user roles and automated notifications to each stage transition.

Custom Fields System

Joomla core contains over 25 native field types (including text, list, media, color, SQL queries, radio buttons, gallery, user, and calendar). Custom fields can be attached to Articles, Categories, Users, and Contact forms, enabling rich structured content modeling directly inside the administrator interface without writing custom database code.

Native Web Services API

Joomla provides an OpenAPI-compliant REST API implementation. Core components (such as content articles, categories, users, tags, banners, and contact forms) automatically expose CRUD endpoints returning standard JSON payloads. This enables developers to use Joomla as a headless backend for mobile applications or modern Jamstack front-ends (built with React, Vue, Next.js, or Nuxt).

Media Manager & Asset Management

The integrated Media Manager supports drag-and-drop file management, directory organization, client-side image editing (crop, resize, rotate), automatic WebP image format generation, and cloud storage adapters (such as AWS S3 or OpenStack).

Architecture

MVC Design Pattern

Joomla's codebase follows strict Object-Oriented Programming (OOP) paradigms and the Model-View-Controller (MVC) architectural pattern:

Model: Encapsulates the application's data layer, business logic, and database queries. It manages state transitions and communicates with the database abstraction layer.
View: Formats and presents the data retrieved from the Model. Views use layout files (typically `.php` templates) to generate HTML, JSON, or XML outputs.
Controller: Intercepts user requests, processes inputs, instantiates Models, and invokes appropriate Views for rendering.

Dependency Injection & PSR Standards

Modern Joomla (versions 4 and 5) heavily utilizes Dependency Injection (DI) through a service container (`Joomla\CMS\Factory::getContainer()`). The core architecture adheres strictly to PHP Framework Interoperability Group (PHP-FIG) standards:

PSR-4: Autoloading standard for class namespaces (`Joomla\CMS\...`).
PSR-7 & PSR-17: HTTP message and factory interfaces for managing HTTP requests and responses.
PSR-11: Container interfaces for object dependency resolution.
PSR-14: Event dispatcher standards for lifecycle event hooks.

Database Abstraction Layer (Database API)

Joomla abstracts database interactions through its Database API, supporting MySQL, MariaDB, and PostgreSQL. Developers construct queries programmatically using dynamic query builders:

$db = Factory::getContainer()->get('DatabaseDriver');
$query = $db->getQuery(true);

$query->select($db->quoteName(['id', 'title', 'introtext']))
      ->from($db->quoteName('#__content'))
      ->where($db->quoteName('state') . ' = 1')
      ->order($db->quoteName('created') . ' DESC');

$db->setQuery($query);
$results = $db->loadObjectList();

This abstraction ensures cross-database compatibility, parameter sanitization, and protection against SQL injection vulnerabilities.

Event Dispatcher & Plugin System

Extensibility in Joomla relies on an event-driven architecture powered by the `EventDispatcher`. Plugins register event listener methods that trigger at specific points in the execution lifecycle, such as:

`onContentBeforeSave`: Triggered before an article or content item is saved to the database.
`onUserLogin`: Executed upon user authentication.
`onAfterRender`: Fired after the application finishes rendering the complete page HTML.

Extensions

Joomla's functionality is extended through five distinct types of extensions, each serving a specific structural role within the framework:

Extension Type	Structural Purpose	Examples / Core Usage
Components	Large functional applications that render main body content. Includes front-end views and backend management interfaces.	`com_content` (Articles), `com_users` (User Management), `com_contact`, VirtueMart.
Modules	Light, flexible block extensions rendered in specific template positions around the main component output.	`mod_menu` (Navigation), `mod_breadcrumbs`, `mod_articles_latest`, `mod_login`.
Plugins	Background event handlers that intercept execution lifecycle events to modify data or add system capabilities.	Content filters, two-factor authentication, SEO canonical tag generators, Search indexers.
Templates	Presentation skins that define visual layout structure, responsive grids, CSS typography, and HTML positions.	Cassiopeia (Front-end default), Atum (Back-end default), third-party frameworks.
Languages	Translation packs containing INI language strings for localized front-end rendering and administration.	English (en-GB), Spanish (es-ES), German (de-DE), French (fr-FR).

Notable Third-Party Extensions

Akeeba Backup: The standard site backup, restoration, and disaster recovery solution for Joomla.
VirtueMart / Hikashop: Complete e-commerce engines offering product catalog management, cart workflows, tax handling, and payment gateway integrations.
RSForm! Pro / ChronoForms: Advanced form builders supporting multi-page forms, calculations, conditional logic, and CRM connections.
JCE Editor (Joomla Content Editor): Enhanced WYSIWYG content editor providing advanced image handling, table management, and code editing features.
Admin Tools: Security firewall suite offering IP blocking, file integrity checks, and administrative hardening.

Templates

Layout Overrides System

One of Joomla's most praised architectural strengths is its native HTML Override System. Developers can override any core component or module HTML output without altering core source code.

By placing customized template view files within the active template directory: templates/YOUR_TEMPLATE/html/com_content/article/default.php

Joomla automatically renders the template override instead of the default core file (`components/com_content/tmpl/article/default.php`), preserving layout customizations across core software upgrades.

Core Templates

Cassiopeia: The default front-end template shipped with Joomla 4 and 5. Built using Bootstrap 5, CSS Grid, and Flexbox layouts, offering high performance, responsive design, and WCAG accessibility standards.
Atum: The default back-end administration template. Designed with accessibility (WCAG 2.1 AA) as a top priority, featuring accessible color contrasts, keyboard navigation, responsive touch points, and dark mode theme switching.

Template Frameworks

Third-party developers frequently utilize template frameworks to construct complex responsive layouts with drag-and-drop page builders:

Helix Ultimate / SP Page Builder: Developed by JoomShaper, offering layout builders, megamenu managers, and Google Fonts integration.
Gantry 5: Developed by RocketTheme, featuring a flexible particle-based layout engine.
YOOtheme Pro: Powerful visual page builder and theme engine providing dynamic content mapping and modern UI utility classes.

Security

Security is a core focus of the Joomla project. The community maintains a dedicated organization called the Joomla Security Task Force (JSST), responsible for monitoring security reports, performing code audits, and releasing security patches.

Built-In Security Features

Multi-Factor Authentication (MFA): Native support for Two-Factor Authentication using TOTP applications (Google Authenticator, Authy), YubiKey hardware tokens, and WebAuthn / Passkeys.
HTTP Security Headers Manager: Built-in administration panel for configuring HTTP security headers, including Content Security Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, and Referrer-Policy.
Strict Parameter Filtering: Centralized input filtering class (`JInput` / `Input`) enforcing strict type sanitization on all GET, POST, and COOKIE parameters.
Prepared Database Statements: Database driver enforces parameterized queries to mitigate SQL injection vectors.
Bcrypt & Argon2 Hashing: Password hashing utilizes modern cryptographic algorithms (Bcrypt and Argon2id) for secure password storage.

Recommended Hardening Practices

Applying core and extension updates promptly via the automated administrative update notification system.
Setting server file permissions strictly (`755` for directories, `644` for files).
Renaming or restricting access to the `/administrator` backend path using IP whitelisting or secondary HTTP authentication.
Installing Web Application Firewalls (WAF) such as Akeeba Admin Tools.

Comparison

The table below compares Joomla with other major open-source content management systems:

CMS Platform	Primary Focus	Technical Complexity	Native Multilingual	Access Control (ACL)	Global Market Share	Core Language
Joomla	Structured Portals & Web Apps	Medium	Native Core Support	Highly Granular (Native)	~2.5% CMS market share	PHP
WordPress	General CMS & Blogging	Low to Medium	Via Extensions (WPML/Polylang)	Basic Roles (Expandable)	~62% CMS market share	PHP
Drupal	Enterprise & Complex Frameworks	High	Native Core Support	Highly Granular (Native)	~2.0% CMS market share	PHP
Ghost	Modern Publishing & Newsletters	Low	Via Custom Themes	Basic Roles	<1% CMS market share	Node.js / JavaScript

Community

The Joomla ecosystem is powered entirely by a worldwide community of volunteers, developers, designers, translators, and site managers:

Open Source Matters, Inc. (OSM): The official non-profit entity providing legal, financial, and organizational oversight for the Joomla project.
Joomla! Extensions Directory (JED): The official directory hosting thousands of community-verified free and commercial extensions.
Joomla Community Magazine (JCM): Monthly online publication featuring articles, tutorials, case studies, and release updates from community contributors.
JoomDays & User Groups (JUGs): Regional conferences and local meetup groups held globally to share knowledge, host workshops, and discuss platform development.

External Links