Get Houston · $39.90

No SSH, no manual cron setup

Set Up Automatic Vulnerability Alerts for Joomla! in 5 Minutes

This is the actual install process, start to finish. For what gets checked and how before installing anything, see how the VEL feed works.

Before you start

Houston needs Joomla 5 or Joomla 6, PHP 8.1 or newer (8.3 or newer for Joomla 6), and a Houston license key from Gumroad to actually run a scan. If your site is still on Joomla 3, Houston is not for it yet: see what Joomla 3 end-of-life actually means and our Joomla! 3 Security Patch instead.

The six steps

  1. Install the package. Extensions → Manage → Install → Upload Package File, then select the Houston package and install. That is the only manual step in the whole process.
  2. Let it enable itself. Houston enables its own plugins and creates its own daily scheduled task in System → Scheduled Tasks automatically on install. There is nothing to configure there by hand.
  3. Activate your license. Enter the Gumroad license key under System → Houston. Without an active license the dashboard is visible, but no scan runs and no findings are generated.
  4. Run the first scan. Wait for the next scheduled trigger, whether that is a real server cron job, Joomla's own lazy scheduler on ordinary visits, or Web Cron, or open System → Houston and trigger Scan Now for an immediate result.
  5. Read the dashboard. System → Houston lists every installed extension, whether Joomla has a newer version on record, and any open finding, filterable by type and to third-party extensions only.
  6. Confirm the alert e-mail arrives. Check spam once after activating. Houston sends through the site's own mailer, so deliverability depends on that domain's SPF, DKIM and DMARC setup, the same as any other transactional e-mail from the site.

What you will see if something is found

A finding shows the extension name, which feed it came from, VEL or the Security Centre, and whatever detail that feed provided. See what a VEL entry can and cannot tell you if a finding looks sparse. Exactly one e-mail goes out for it. It then stays visible on the dashboard without sending another e-mail every day, only when the finding itself is new.

← Back to Houston

Frequently asked questions

Do I need SSH or command-line access to install Houston?

No. The whole install happens through the Joomla admin, starting with a normal extension package upload.

What happens if I install Houston without activating a license yet?

The dashboard and extension inventory are visible immediately. No scan runs and no findings are generated until a license is activated.

Can I trigger a scan manually instead of waiting for the daily schedule?

Yes. System → Houston has a Scan Now option for an immediate run.

What if my host does not support real server cron jobs?

Houston runs on whichever trigger the site already has, including Joomla's own lazy scheduler on ordinary visits or Web Cron, so a dedicated server cron job is not required.