Joomla Update Error 999: a Dead Extension Redirecting to LinkedIn

You open a Joomla site to run updates, or you glance at your update dashboard, and you get this:

Invalid status code "999"; must be an integer between 100 and 599, inclusive.
Your site responded with Invalid status code "999".

Nothing you did is wrong. This is not a Joomla bug, and if you saw it in mySites.guru, it is not a mySites.guru bug either. One of your installed extensions is pointing its update check at a web address that no longer serves an update file. Here is exactly what the 999 means and the two-minute fix.

If you manage more than a handful of Joomla sites, the 999 error has a habit of showing up on almost all of them at once, because the culprit is usually a single extension you installed everywhere. mySites.guru reads every update-site URL your sites report in its twice-daily snapshot, so you can find the dead one and clear it across your whole portfolio of Joomla sites instead of hunting site by site.

What does “Invalid status code 999” mean in Joomla?

999 is not a real HTTP status code. Every valid HTTP response carries a three-digit status between 100 and 599, and 999 sits outside that range, so no well-behaved server should ever return it. LinkedIn is the exception: it replies with 999 to block automated traffic it does not recognise. If your Joomla update check lands on a 999, the request ended up at LinkedIn instead of at an update file.

So how does a Joomla update check end up at LinkedIn? Through an extension whose developer walked away.

Why an abandoned extension breaks your Joomla update check

Every Joomla extension that supports updates registers an “update site”: a URL Joomla calls to ask “is there a newer version?”. The developer owns that URL. When a developer abandons an extension and lets the domain or the update path lapse, that URL can start doing something it was never meant to do.

The one that bites Dutch Joomla sites most often is an abandoned Dutch translation pack, RSJoomla! Dutch Translations by Wilco Alsemgeest. Its update site at con-con.nl now issues a 301 redirect straight to the author’s LinkedIn profile. Joomla follows the redirect, LinkedIn decides the request is not a real browser, and LinkedIn answers 999.

Under the bonnet, Joomla fetches update XML through its own HTTP library (joomla/http), which is built on laminas-diactoros. Diactoros validates the status line of every response and throws the instant it sees a code outside the valid range:

Invalid status code "999"; must be an integer between 100 and 599, inclusive

That check fires before Joomla ever gets to compare the response against 200, which is why the update simply stops with the raw exception rather than a tidy “no update available”. The rule Diactoros is enforcing is not arbitrary. RFC 9110, the HTTP standard, defines a status code as a three-digit integer and reserves the entire valid space to 100 through 599. 999 is not in it.

This is version-agnostic. It has nothing to do with which Joomla you run: sites on Joomla 4, 5, and 6 all hit it the same way because they share the same HTTP library. It also breaks Joomla’s own Pre-Update Check, so a single dead update site can block you from upgrading the CMS at all.

How do I find the update site causing the 999 error?

Go to Extensions, then Manage, then Update Sites in your Joomla administrator. That screen lists every update URL your installed extensions have registered, and you are looking for one that redirects off-site.

Confirm it from the command line with curl:

curl -sI -L "https://con-con.nl/ReleaseSystem/rsjoomla.xml"

A healthy update site returns 200 and some XML. A dead one looks like this:

HTTP/2 301
location: https://www.linkedin.com/in/wilcoalsemgeest/
HTTP/2 999

The 301 to a LinkedIn profile followed by a 999 is the smoking gun. LinkedIn’s response even carries an x-li-fabric header, so there is no doubt about where the request ended up.

If you would rather not touch the command line, mySites.guru shows the exact update-site URL for every stream on each site, so you can eyeball the list and spot the odd domain. It is worth checking where every extension’s update site actually points regardless, because almost nobody does, and an update URL is a route straight into your site’s update process.

How do I fix the 999 update error in Joomla?

Delete the offending update site, do not just disable it. In Extensions, Manage, Update Sites, select the dead entry and use Delete. If the extension itself is genuinely abandoned and you no longer need it, uninstall the extension too, which removes the update site for good.

If you use mySites.guru, do one more thing. Open Manage Site, then Config, scroll to the bottom, and turn off “re-enable disabled update sites”. Otherwise mySites.guru switches the dead site back on at the next check and the error returns.

Why disabling the update site isn’t enough

Joomla treats update sites as disposable and rebuilds them from each extension’s manifest. Disable one and the next “Find Updates” run can switch it straight back on. This is documented behaviour: the Rebuild button repopulates the update-sites table from your installed extensions’ manifest files, and Joomla has re-enabled disabled update sites on update checks for years (issue #13436).

A disable is temporary. A delete holds until the next rebuild. Uninstalling the dead extension is the only change that holds permanently, because there is no manifest left to rebuild from.

Can mySites.guru just ignore the 999 code?

No, and it would not help if it did. This question comes up every time: “can you patch your validator to accept 999 so the error goes away?” We will not, for two reasons.

First, 999 is genuinely not a valid HTTP status. Teaching our tooling to trust malformed responses is exactly the kind of shortcut that hides real problems later.

Second, and more practically, it would not fix anything. Even if mySites.guru swallowed the 999, Joomla’s own update client on your site still rejects it, so you would keep hitting the same wall in Joomla’s Update Manager and Pre-Update Check. The error is not in the validator. It is an abandoned update site, and that is where it has to be fixed. Do that once and it is fixed everywhere: in Joomla, in mySites.guru, and in any other tool that reads your update sites.

If you want to push the extension author to fix it, the argument is simple. Their update site redirects to LinkedIn, LinkedIn returns a code that is not in the HTTP specification, so any client that respects the spec breaks. That is on the update site, not on Joomla.

Managing update sites across a portfolio of Joomla sites

Here is the pattern we see across large Joomla portfolios: one popular extension installed on every site, one dead update URL, and suddenly the update dashboard is red almost everywhere at once. A Dutch agency we work with hit exactly this, the same abandoned extension flagging the 999 across nearly their entire client list when they sorted their updates by site.

At that scale, fixing it by hand on each site is the wrong tool. mySites.guru reads the update-site URLs from every connected site, so you can find the offender once and clear it everywhere, and the “re-enable disabled update sites” toggle keeps it gone. If you would rather we just sorted it, send us the details and we will look for free.

The 999 error vs the “offered update has expired” error

These two look similar and are completely different. The 999 error is a dead third-party update site on your own site. The “offered update has expired” error is a problem at Joomla’s end, where the signed update metadata that Joomla.org serves has gone stale. One you fix on your site, the other you wait out or work around. If your update is failing, check which message you actually got before you change anything.

One naming clash is worth clearing up too. This 999 has nothing to do with the Joomla 3.10.999 project, which is Phil’s community security-patch repository for end-of-life Joomla 3. Same three digits, unrelated problem.

Further Reading

• RFC 9110, HTTP Semantics (Section 15) - the standard that defines valid HTTP status codes as three-digit integers from 100 to 599.
• http.dev: the 999 status code - why 999 is non-standard, unregistered with IANA, and used by LinkedIn to block non-browser traffic.
• MDN: HTTP response status codes - the five valid status-code classes.
• Joomla Documentation: Update Sites - how Joomla stores, rebuilds, and manages extension update sites.
• UptimeRobot: a deep dive into the HTTP 999 status code - an accessible explainer of 999 as a bot-block response.

If you are not already using mySites.guru to watch your Joomla and WordPress sites, create an account and let it surface broken update sites, failed updates, and security issues across everything you manage.