Get Houston · $39.90

Before something goes wrong

Does Your Joomla! Site Have a Vulnerable Extension? A Checklist

This is not the same question as "is my site hacked": that is about signs of an active compromise, and we cover it separately for Joomla! 3 sites in our hacked-site checklist. This one comes earlier and is quieter: how do you tell, before anything goes wrong, whether one of your installed extensions has a disclosed vulnerability sitting there unpatched?

Manual signs you can check today

  • Compare your Joomla core version against the latest release. System → Joomla Update flags version drift, though it flags any newer release, not vulnerability status specifically.
  • Check whether Joomla's own VEL feed lists any of your installed extensions by name. See how the feed itself is structured before searching it by hand.
  • Read each extension's own changelog for security language. Terms like "security fix", "XSS" or "SQL injection", even without a formal CVE attached, are worth checking further.
  • Flag extensions with no update in a long time. An extension untouched for two or more years has not necessarily been re-checked against vulnerability classes discovered since.
  • Check System → Extensions for anything installed but never actually used. An unused extension still executes code, and still carries any vulnerability it has.

Why this breaks down manually

Each of these checks takes a few minutes for one extension. A typical Joomla site runs somewhere between 20 and 50 extensions once components, plugins, modules and templates are all counted, and an agency managing a portfolio of client sites multiplies that further. Manual, one-by-one checking works fine as a one-time audit. It does not work as an ongoing practice, because nobody actually repeats a 30-minute manual check every week across dozens of sites, and a vulnerability disclosed in an extension installed six months ago is exactly as real as one disclosed yesterday if nobody has re-checked it since.

What automating it looks like

This is the specific gap our Houston closes: it runs the VEL and Security Centre checks above automatically, every day, against the actual installed inventory, and e-mails only when a finding is genuinely new. See how to set it up to stop doing this by hand. If you are coming from WordPress, see how this compares to Wordfence and WPScan.

← Back to Houston

Frequently asked questions

Does zero vulnerabilities in VEL for an extension mean it is safe?

No. It means nothing has been reported yet, not that nothing exists. VEL is a record of known, disclosed issues, not a guarantee.

What if an extension has no changelog at all to check?

That is itself worth noting. No changelog usually also means no visibility into whether known issues ever get addressed.

How long does checking one site by hand actually take?

A few minutes per extension, so an hour or more for a typical 20-to-50-extension site, and that has to be repeated regularly to stay current, not done once.

Should unused, disabled extensions still be checked?

Yes. A disabled extension's files are usually still present on the server. If it is ever re-enabled, or if its code is reachable directly, any vulnerability it has is still real.