Is my Joomla 3 site still safe?
No. Joomla 3 has had no security fixes since August 2023, so known holes stay open. Plan the move to a supported version.
Why not
Joomla 3.10 support ended on 16 August 2023. Since then the Joomla project has released no security fixes for it. New security problems that are found in Joomla 3, or in the old extensions that only run on it, stay open.
The site may keep running for years, but attackers scan for exactly these old versions. Many Joomla 3 sites also run on old PHP versions that no longer get security fixes either.
What to do now
- Make a full backup and keep it off the server.
- Remove extensions you don't use, and check the rest against the Vulnerable Extensions List.
- Use strong passwords and limit who can log in to the administrator.
- Plan the move to Joomla 5 or 6 (see "How do I move from Joomla 3 to Joomla 5 or 6?").
Good to know
- Some companies sell extended security support for Joomla 3. It buys time, but the move still has to happen.
Sources
- Joomla 3 to 4 Step by Step – Joomla User Guide
- Vulnerable Extensions – Joomla User Guide
- Security Best Practices – Joomla User Guide
