Extensions and plugins
The third-party code with the same privileges as the CMS itself.
8 checks in this group, 2 with a full write-up.
Not the vulnerability list, the housekeeping list
An outdated or vulnerable extension is a different problem from the ones in this group, and it is tracked separately: mySites.guru’s vulnerability database flags specific versions of specific extensions with known security holes. What lives here instead is smaller and easy to overlook because none of it involves a CVE: sample data still installed in production, a guided-tour plugin still active on a live site months after launch, a privacy consent plugin that exists but was never published, backward-compatibility layers left enabled long after the code that needed them was updated or removed.
The common thread is settings that made sense during development and were never revisited for production, which is the same pattern that runs through Joomla and WordPress configuration more broadly, just scoped to the extension layer rather than the core one. A backward-compatibility plugin in particular is worth understanding before switching it off rather than after: it exists because something on the site, possibly a template, possibly another extension, still calls the older classes it re-adds, and disabling it blind can break a page that was working fine.
Because every extension and plugin runs with essentially the same privileges as the CMS itself, even “housekeeping” issues in this group are worth taking seriously at portfolio scale. A dormant plugin left enabled is not doing anything malicious on its own, but it is one more piece of code capable of reaching the whole site if it is ever the one with the vulnerability that does get exploited, which is an argument for running less of it in production, not more.
Joomla
Privacy: Publish Privacy Consent Plugin
Checks whether the built-in Joomla privacy consent plugin is enabled, which is what actually records that a user agreed before you process their data.
User Action Log Plugins Should Be Enabled
Checks whether the Joomla action log plugins are enabled, so there is a record of who changed what if the site is later compromised.
Disable Joomla Guided Tours Plugin In Production
Checks whether the Guided Tours plugin is published: it ships enabled by default and is an unnecessary surface once you know the admin console.
Fixable in one click60.3% of the Joomla sites we have this data for fail it
Enable Image Thumbnails To Speed Up Media Manager In Joomla 4.3+
Checks whether thumbnail generation is switched on in the Local filesystem plugin, since Media Manager becomes noticeably slower to browse without it.
Fixable in one click
"Behaviour - Backward Compatibility 6" Plugin (plg_behaviour_compat6, J5 Classes) - Warning! LEARN before disabling!
Reports whether the plugin that keeps deprecated Joomla 5 classes working is still enabled, letting old extensions run before the next major upgrade.
Fixable in one click
"Behaviour - Backward Compatibility" Plugin (plg_behaviour_compat, J4 Classes) - Warning! LEARN before disabling!
Reports whether the plugin keeping deprecated Joomla 4 classes working on Joomla 5 is still enabled, delaying extension updates needed for Joomla 6.
Fixable in one click
Disable Sample Data In Production
Detect and disable the Joomla Sample Data module and its install plugins
Fixable in one click
WordPress
Delete Files For Deactivated Plugins
A deactivated plugin's files still sit on disk and can still be reactivated or reached directly, so any known vulnerability in its code remains part of your attack surface.
Find out which of these your sites fail
Connect a site and every check in this group runs against it automatically, with the result and the fix in one place. These run twice a day on every connected site.
Run a free audit