Disable Joomla Guided Tours In Production

What this check and mySites.guru tool looks at on your site

This check reads your Joomla site’s #__extensions table and looks at all three of the extensions that make up Guided Tours: the System - Guided Tours plugin, the com_guidedtours component, and the mod_guidedtours administrator module. Joomla has seeded all three enabled on every install since 4.3.0, so an untouched site still has the whole feature running.

Those three rows are reported as one state rather than three separate findings. What you want to know is whether the feature as a whole is still live on a production site, and one particular mix of the three is worth telling apart from the rest: with the component disabled and the plugin still enabled, a Joomla 5.2 or later site goes on starting tours that can no longer be dismissed. The check reads that combination as broken rather than as half fixed.

If you have never come across the feature by name, Guided Tours is the overlay that highlights one part of the admin console at a time and walks a logged-in user through it step by step, with a “next” prompt moving them on to the following highlighted element. It is built into Joomla itself, sitting under System in the administrator menu, and the tours it can show are defined either by Joomla core or by a third-party extension that ships its own.

Why running code you don’t need still costs you

Guided Tours was introduced in Joomla 4.3.0, in April 2023, to let the core team and extension developers build a step-by-step walkthrough overlay inside the administrator console. It is a useful onboarding feature for someone who has never used Joomla before: a series of guided steps pointing at exactly where to click.

Once your team knows the backend, that job is finished. A plugin that stays enabled after its purpose is served is not a dramatic security hole, but it is unnecessary surface area on a production site: it still runs on every admin page load, still has UI hooks into the console, and still represents code that could, like any plugin, be found to have its own vulnerability down the line. The general discipline of disabling anything you are not actively using is one of the cheapest hardening steps available, and Guided Tours is a clean example of a feature that is valuable during onboarding and dead weight afterwards.

There is also a simple mismatch worth naming: guided tours exist to teach new users the admin console, but a production site is not where new users should be learning it in the first place. A staging or training environment is the place to leave a tour running.

There is a second reason worth naming, separate from the tour content itself. Every enabled plugin runs its bootstrap code on every request that triggers its event, whether or not anyone actually benefits from what it does. That is a small, constant cost on every admin page view: more code executing, more hooks firing, one more moving part in the console to account for when something in the backend starts behaving oddly. None of this is dramatic in isolation. It is the accumulation of exactly this kind of “leave it on, it’s probably fine” thinking across dozens of unused plugins that turns a lean admin console into a bloated one. Guided Tours is a clean, low-stakes example of a habit worth having generally: once a feature has finished doing its job, switch it off rather than leaving it running by default.

Unpublished once your team knows the backend

All three Guided Tours extensions belong unpublished (disabled) on any site that has gone live, unless you are actively using tours. Once you and your admin team are past the point of needing a walkthrough, there is nothing they add. If you manage several Joomla sites the same way, it is worth making this a standard step in your go-live checklist rather than something you only think about after an audit flags it, since it takes seconds to disable and there is rarely a reason to revisit the decision later. This check reads the three extensions’ own published state directly, so there is no separate dashboard setting to double-check once they are off.

How to fix it

1. Log in to https://yoursite.com/administrator.
2. Go to System then Manage then Plugins.
3. Search for Guided Tours.
4. Click the green tick in the Status column to unpublish it (a red cross means it is already disabled).
5. Go to System then Manage then Extensions.
6. Search for Guided Tours again. The component and the administrator module are listed there alongside the plugin you have just switched off.
7. Tick both and click Disable in the toolbar.
8. Reload the Home Dashboard and confirm the tour prompt, the menu entry and the dashboard tile have all gone.

Joomla offers you that Disable button on its own Extensions: Manage screen because none of the three is a protected extension. The protected flag on the plugin, the component and the module is 0 in every Joomla release from 4.3.0 onwards, which is precisely what allows a Super User to switch them off. This is a supported Joomla operation, not a workaround.

Disable them, never uninstall them. All three are flagged locked, which blocks uninstall while leaving disable available, and there is no reason to go deleting core Joomla files.

Take the plugin off first and leave it off. On Joomla 5.2 and later, a site with the component disabled while the plugin is still enabled is worse off than a site left alone: tours still start, but the button that dismisses them has nowhere to save to, so the same tour reopens on every admin page load. Re-enabling the plugin on its own months later, from the Plugins manager, drops you into exactly that state.

If you or a colleague later need the walkthrough again, perhaps after a major Joomla upgrade changes the admin layout, the same steps in reverse re-enable it, plugin and component together. Nothing about disabling these extensions removes the tour content itself. The #__guidedtours and #__guidedtour_steps tables are never written to, so switching them back on restores exactly what was there before, including any tours a third-party extension installed or you wrote yourself, with no reinstallation or reconfiguration required.

What mySites.guru does about it

This check runs on every connected site as part of the fast snapshot, twice a day, so a re-enabled tours plugin is picked up quickly. It has a one-click fix, and that one click now switches off all three extensions rather than only the plugin.

It does that in a single database statement instead of three separate ones, on purpose, so it cannot half-apply and leave a site sitting in the broken combination above. It then clears the Joomla caches that would otherwise go on showing the menu entry and the dashboard tile after the change, so what you see in the backend matches what the database now says.

If you manage a portfolio of Joomla sites brought under management at different times, that one click is usually faster than logging into each backend in turn to track down which of them still has the default state left over from installation.