Remove Sample Data From A Production Site

What this check and mySites.guru tool looks at on your site

On every snapshot, this check reads your Joomla site’s #__extensions table and reports two separate facts: whether the mod_sampledata administrator module is enabled, and how many of Joomla’s three core Sample Data plugins (blog, multilang, testing) are still enabled. They are reported separately because they are not the same thing, and only one of them actually controls anything.

One click your own team can make, not an attacker

Joomla puts a Sample Data panel on the administrator Home Dashboard. Clicking it installs a full set of demo content: articles, categories, tags, custom field groups, menus, menu items, modules, and a nine-stage editorial workflow. The multilingual version goes further still, enabling the language filter plugin, creating content languages and publishing new modules. None of it can be undone. Joomla says so itself in its own confirmation box: “Proceeding will install a sample data set into your Joomla website. This process can’t be reverted once done.” Neither plugin contains any code to remove what it created, so cleaning up afterwards is entirely manual.

The detail that catches people out is this: unpublishing the module does not disable Sample Data. The panel on your dashboard is only a button. Clicking it calls a completely different address, /administrator/index.php?option=com_ajax&group=sampledata&plugin=SampledataApplyStep1. Joomla’s com_ajax component behaves differently depending on what parameter it receives. Ask it for a module and it checks whether that module is enabled. Ask it for a plugin, as this button does, and it simply loads the plugin group and runs it, so the module’s published state is never looked at. Hide the panel, and that address still works exactly as before.

What actually closes it off is disabling the three plugins. Joomla only loads plugins that are enabled, so with them off there is no handler registered for that request, and nothing happens when it is called. The same lookup fills the dashboard panel, so hiding the plugins empties the panel too, as a side effect rather than the mechanism.

It is also not restricted to Super Users, even though the dashboard makes it look that way. The panel itself is set to the Super Users view level, so most backend users never see the button. But the plugins behind it check ordinary content and installer permissions instead, not Super User status. Anyone with permission to create content, menus and modules, edit tags, and manage the installer can trigger the whole process without ever seeing the panel that supposedly gates it.

To judge the risk fairly: this is not a way in for an outside attacker. A logged-out visitor cannot trigger it, and a valid session token is required, so it cannot be fired from another website. It is a mistake a member of your own team can make by clicking a genuine, working admin feature, not a vulnerability a stranger can exploit.

The module and all three plugins disabled

Both the mod_sampledata module and all three core Sample Data plugins disabled on any site that is live. Sample Data exists to help someone evaluate or learn Joomla on a fresh install; on a site that is already running, there is nothing it can add that you actually want, and one accidental click creates content you then have to unpick by hand.

If other extensions you use, such as DPCalendar or Kunena, ship their own Sample Data plugins, those are unrelated. This check and its fix only ever touch the three plugins that come with Joomla core.

How to fix it

1. Log in to https://yoursite.com/administrator.
2. Go to System then Manage then Plugins.
3. Search for sample data and disable all three results: Sample Data - Blog, Sample Data - Multilang and Sample Data - Testing.
4. Optionally, go to Content then Site Modules, find Sample Data, and unpublish it too, purely to tidy the dashboard. This step alone does not close the gap; step 3 is what matters.

A Joomla update will not undo this for you, but it will not undo your fix either. No Joomla update script touches these rows, so once you disable the plugins they stay disabled through your next point release.

If sample content has already been installed on a live site, disabling the plugins stops it happening again but does not remove what is already there. You will need to go through Content, Menus and Modules and manually delete the demo articles, categories, tags, menu items and modules the install created, since neither plugin ships an undo path of its own.

What mySites.guru does about it

This check runs on every connected site as part of the fast snapshot, twice a day. It has a one-click fix that works in both directions: mySites.guru can disable mod_sampledata and all three core Sample Data plugins across every connected site at once, or re-enable them if you genuinely need to demonstrate Joomla on a specific site. We change the extensions themselves rather than the module’s dashboard placement, which is deliberate: Joomla lets a module be duplicated, so switching the feature back on later would otherwise republish copies you had intentionally hidden.