A compromised site needs recovery, not just an update
Unknown administrators, malicious files, redirects or injected content require investigation, cleanup and credential rotation. A normal Joomla update does not prove that backdoors are gone.
Know the change
Routine update or major-version migration?
- Maintenance or minor update
- Usually handled by Joomla Update after a backup and compatibility review.
- Major-version upgrade
- May require a pre-update check, extension replacements, template work and staged testing.
- Unsupported old release
- Plan a migration path rather than repeatedly forcing current packages into the legacy installation.
- Custom or abandoned extension
- Obtain a compatible release, replacement or developer plan before updating core.
Before updating
Build a rollback and compatibility plan
- Back up all files and the database and confirm the restore location.
- Record Joomla, PHP, template and extension versions.
- Run the pre-update check for a major Joomla upgrade.
- Check third-party developers for compatible packages and migration steps.
- Remove abandoned extensions only after confirming they are not used.
Controlled maintenance
Update extensions, then Joomla
- Open the administrator area and check System > Update Panel.
- Update supported extensions and the active template to releases compatible with the target Joomla version.
- Clear the update cache and rerun the compatibility check.
- Use Joomla Update for the supported core update or approved migration path.
- Complete any database schema fixes shown by the system.
- Clear caches and inspect warnings before reopening the site.
Acceptance test
Verify the public and administrator experience
- Test the home page, inside pages, menus, modules, forms and search.
- Open the administrator area and save a harmless existing item.
- Check mobile layout, outgoing email, scheduled tasks and PHP logs.
- Retain the pre-update backup until normal operation is confirmed.
If it fails
Restore once, then investigate compatibility
Record the exact error and failing component. If the site cannot be made safe quickly, restore the complete verified backup rather than mixing old database state with partially updated files. A repeated failed migration needs a staged copy, not more live retries.
Need help with a Joomla update or migration?
Send the domain, Joomla and PHP versions, target version, template, important extensions, pre-update check results, exact error and backup date. State whether compromise is suspected. Never send passwords.
Ask the Joomla team