Disable The Joomla Guided Tours Plugin In Production

What this check and mySites.guru tool looks at on your site

This check reads your Joomla site’s #__extensions table and looks at the published state of the System - Guided Tours plugin. If it is enabled on a live site, the check flags it.

If you have never come across the feature by name, Guided Tours is the overlay that highlights one part of the admin console at a time and walks a logged-in user through it step by step, with a “next” prompt moving them on to the following highlighted element. It is built into Joomla itself, sitting under System in the administrator menu, and the tours it can show are defined either by Joomla core or by a third-party extension that ships its own.

Why running code you don’t need still costs you

Guided Tours was introduced in Joomla 4.3.0, in April 2023, to let the core team and extension developers build a step-by-step walkthrough overlay inside the administrator console. It is a genuinely useful onboarding feature for someone who has never used Joomla before: a series of guided steps pointing at exactly where to click.

Once your team knows the backend, that job is finished. A plugin that stays enabled after its purpose is served is not a dramatic security hole, but it is unnecessary surface area on a production site: it still runs on every admin page load, still has UI hooks into the console, and still represents code that could, like any plugin, be found to have its own vulnerability down the line. The general discipline of disabling anything you are not actively using is one of the cheapest hardening steps available, and Guided Tours is a clean example of a feature that is genuinely valuable during onboarding and genuinely dead weight afterwards.

There is also a simple mismatch worth naming: guided tours exist to teach new users the admin console, but a production site is not where new users should be learning it in the first place. A staging or training environment is the place to leave a tour running.

There is a second reason worth naming, separate from the tour content itself. Every enabled plugin runs its bootstrap code on every request that triggers its event, whether or not anyone actually benefits from what it does. That is a small, constant cost on every admin page view: more code executing, more hooks firing, one more moving part in the console to account for when something in the backend starts behaving oddly. None of this is dramatic in isolation. It is the accumulation of exactly this kind of “leave it on, it’s probably fine” thinking across dozens of unused plugins that turns a lean admin console into a bloated one. Guided Tours is a clean, low-stakes example of a habit worth having generally: once a feature has finished doing its job, switch it off rather than leaving it running by default.

Unpublished once your team knows the backend

The System - Guided Tours plugin unpublished (disabled) on any site that has gone live, unless you are actively using it. Once you and your admin team are past the point of needing a walkthrough, there is nothing this plugin adds. If you manage several Joomla sites the same way, it is worth making this a standard step in your go-live checklist rather than something you only think about after an audit flags it, since it takes seconds to disable and there is rarely a reason to revisit the decision later. This check reads the plugin’s own published state directly, so there is no separate dashboard setting to double-check once the plugin itself is off.

How to fix it

1. Log in to https://yoursite.com/administrator.
2. Go to System then Manage then Plugins.
3. Search for Guided Tours.
4. Click the green tick in the Status column to unpublish it (a red cross means it is already disabled).
5. Reload the Home Dashboard and confirm the tour prompt no longer appears for new admin sessions.

If you or a colleague later need the walkthrough again, perhaps after a major Joomla upgrade changes the admin layout, the same steps in reverse re-enable it. Nothing about disabling the plugin removes the tour content itself, so switching it back on restores exactly what was there before, with no reinstallation or reconfiguration required.

What mySites.guru does about it

This check runs on every connected site as part of the fast snapshot, twice a day, so a re-enabled tours plugin is picked up quickly. It has a one-click fix: mySites.guru can disable the Guided Tours plugin across every connected site at once, rather than you logging into each Joomla backend in turn to flip the same setting. If you manage a portfolio of Joomla sites brought under management at different times, that one click is usually faster than tracking down which of them still has the default state left over from installation.