Skip to main content
mySites.guru
New features added last monthRelease RadarFile ManagerImpostor FilesUpdate QueueRogue AdminsMCP & APIJoomla VELCVE Index

Extensions and plugins

The third-party code with the same privileges as the CMS itself.

11 checks in this group, 2 with a full write-up.

Not the vulnerability list, the housekeeping list

An outdated or vulnerable extension is a different problem from the ones in this group, and it is tracked separately: mySites.guru’s vulnerability database flags specific versions of specific extensions with known security holes. What lives here instead is smaller and easy to overlook because none of it involves a CVE: sample data still installed in production, a guided-tour plugin still active on a live site months after launch, a privacy consent plugin that exists but was never published, backward-compatibility layers left enabled long after the code that needed them was updated or removed.

The common thread is settings that made sense during development and were never revisited for production, which is the same pattern that runs through Joomla and WordPress configuration more broadly, just scoped to the extension layer rather than the core one. A backward-compatibility plugin in particular is worth understanding before switching it off rather than after: it exists because something on the site, possibly a template, possibly another extension, still calls the older classes it re-adds, and disabling it blind can break a page that was working fine.

Because every extension and plugin runs with essentially the same privileges as the CMS itself, even “housekeeping” issues in this group are worth taking seriously at portfolio scale. A dormant plugin left enabled is not doing anything malicious on its own, but it is one more piece of code capable of reaching the whole site if it is ever the one with the vulnerability that does get exploited, which is an argument for running less of it in production, not more.

Joomla

  • Privacy: Publish Privacy Consent Plugin

    Checks whether the built-in Joomla privacy consent plugin is enabled, which is what actually records that a user agreed before you process their data.

    94.8% of the Joomla sites we have this data for fail it

  • User Action Log Plugins Should Be Enabled

    Checks whether the Joomla action log plugins are enabled, so there is a record of who changed what if the site is later compromised.

    5.5% of the Joomla sites we have this data for fail it

  • Disable Joomla Guided Tours In Production

    Checks whether Joomla Guided Tours is still switched on. It ships enabled and is three extensions, not one: the system plugin, the component and the admin module.

    Fixable in one click18.3% of the Joomla sites we have this data for fail it

  • Enable Image Thumbnails To Speed Up Media Manager In Joomla 4.3+

    Checks whether thumbnail generation is switched on in the Local filesystem plugin, since Media Manager becomes noticeably slower to browse without it.

    Fixable in one click

  • "Behaviour - Backward Compatibility 6" Plugin (plg_behaviour_compat6, J5 Classes) - Warning! LEARN before disabling!

    Reports whether the plugin that keeps deprecated Joomla 5 classes working is still enabled, letting old extensions run before the next major upgrade.

    Fixable in one click

  • "Behaviour - Backward Compatibility" Plugin (plg_behaviour_compat, J4 Classes) - Warning! LEARN before disabling!

    Reports whether the plugin keeping deprecated Joomla 4 classes working on Joomla 5 is still enabled, delaying extension updates needed for Joomla 6.

    Fixable in one click

  • Disable Sample Data In Production

    Detect and disable the Joomla Sample Data module and its install plugins

    Fixable in one click

  • Joomla Redirect Plugin Should Be Enabled If You Use Redirects

    Checks whether the core System - Redirect plugin is enabled, and reports the site as broken when it is switched off while redirects are still configured to fire.

    Fixable in one click

  • Stop The Redirect Plugin Recording Every 404 URL

    Checks whether the core System - Redirect plugin is recording every 404 it sees into #__redirect_links, and lets you switch the recording off without disabling the plugin.

    Fixable in one click

  • Recorded 404 URLs Should Not Pile Up

    Counts the 404 URLs the core System - Redirect plugin recorded and left unactioned, and lets you review and delete them a selection at a time.

WordPress

  • Delete Files For Deactivated Plugins

    A deactivated plugin's files still sit on disk and can still be reactivated or reached directly, so any known vulnerability in its code remains part of your attack surface.

Find out which of these your sites fail

Connect a site and every check in this group runs against it automatically, with the result and the fix in one place. These run twice a day on every connected site.

Run a free audit