Joomla Update Guide 2026

Why regular Joomla updates are mandatory

Joomla is one of the most widely used open source CMS platforms worldwide and therefore an attractive target for attacks. Every unpatched security vulnerability is an open door. According to Wordfence and Sucuri, more than 80 % of all hacked CMS sites are compromised through outdated components, not through the core itself.

Concrete risks when updates are delayed:

• Loss of SEO ranking through Google blacklisting after a malware infection
• GDPR violation on data leak (fines up to 4 % of annual revenue)
• Hosting suspension by the provider when the site is compromised
• Recovery costs of 500–5 000 EUR per incident

Preparation: backup, staging, maintenance mode

Before you touch anything:

1. Complete backup of the database and the file system. At minimum back up the current configuration.php, /components/, /modules/, /plugins/ and /templates/. Tools: Akeeba Backup, JoomlaPack or server-side via mysqldump + tar.
2. Staging clone on a subdomain (staging.yourdomain.com), here you test the update first. Mittwald, all-inkl and Strato offer one-click clones.
3. Enable maintenance mode: System, Configuration, Site, "Site Offline". Visitors then see a clean maintenance page instead of half-rendered PHP errors.
4. Clear the cache: System, Maintenance, Clear Cache. Otherwise update scripts tend to hang on stale class caches.

Updating the Joomla core (step by step)

Joomla 4.x to Joomla 5.x or patch update within 5.x:

1. Log into the backend, System, Update, Joomla
2. Run the pre-update check. Joomla now shows whether extensions are incompatible. Never ignore the warnings.
3. Check the PHP version: Joomla 5.x requires PHP 8.1+. With older hosting, contact the provider first.
4. Click "Install". Do not close the browser tab during the process; if interrupted the database migration ends up in an inconsistent state.
5. After the update: clear the cache, check the frontend, test the login, force a backend reload (Ctrl+Shift+R).

Updating components, modules and plugins

Extensions are the main attack target. Order:

1. Security plugins first (Akeeba Admin Tools, RSFirewall, Brute Force Stop)
2. Core-adjacent components (Akeeba Backup, sh404SEF, JCE Editor)
3. Frontend modules (sliders, forms, galleries)
4. Templates last; they often ship with source code customizations, check the diff first

System, Update, Extensions, "Find Updates", update one by one. With ten or more updates in parallel it regularly happens that one component fails and drags the others down with it.

Common update errors & fixes

Error: "Update server could not be reached"

Usually an allow_url_fopen=Off problem or a firewall rule at the host. Solution: switch the update URL in the extension options manually to HTTPS or ask the host to allow updates.joomla.org.

Error: "Database migration failed"

System, Maintenance, Database, click "Fix structure errors" and "Repair". If that does not help: apply the SQL script of the Joomla update file (/administrator/components/com_admin/sql/updates/mysql/) manually.

Error: White screen (White Screen of Death)

Set error_reporting in configuration.php to maximum, then Joomla shows the real PHP error. Common cause: an incompatible template or an override in /templates/yourtemplate/html/ that runs against an old class.

Manage multiple Joomla sites centrally

If you maintain 5, 10 or 50 Joomla sites you cannot log into each site individually. This is where UpdateKing comes in: one plugin per site, one central dashboard, one click to update. Advantages over the single login workflow:

• Time savings: 30 seconds per site instead of 8–12 minutes of backend login plus update procedure
• Overview: Immediately visible which sites have critical pending updates
• GDPR compliant: Servers in Germany, no US cloud, no tracking
• Logging: Every action with a timestamp, verifiable during audits

Create a free account , the first site is permanently free on the Starter plan.

FAQ

How often should I update Joomla?

Security updates: immediately, no later than within 24–48 hours. Feature updates: monthly. Component updates: check weekly.

What to do if a Joomla update fails?

Restore the backup, check the error log (administrator/logs/), identify the conflicting extension and update it separately. For database errors, trigger the last migration step in the Joomla Update Manager manually.

Can I have Joomla updated automatically?

Yes, with the UpdateKing plugin all Joomla sites are managed centrally and updated with one click. Updates run in a controlled way with full logging, no blind auto updates without visual confirmation, because a failed auto update on 30 sites at once is the worst case scenario.

What does a Joomla maintenance contract cost?

Pure update management by an agency: 19–39 EUR per site and month. Complete packages including hosting and support are usually 49–149 EUR. With UpdateKing you drastically reduce the effort and can offer your own maintenance contracts profitably, the tooling in the Agency plan costs only 50 cents per site.

Further reading: Joomla maintenance for multiple sites · Joomla security checklist · To the UpdateKing homepage