Skip to main content
mySites.guru
4+ live

Joomla extension security alerts (28 Aug) ZOO: unauth RCESourcerer 16.0.0Fabrik 4.7.2JCE 2.9.99.10

Joomla

Search Engine Friendly URLs

Search Engine Friendly URLs

Search Engine Friendly URLs turn Joomla's query-string links into readable, keyword-rich URLs. It's an SEO setting, not a security one, and it's easy to enable.

How common is this?

  • 0.7% of the Joomla sites we have this data for fail this check. Platform: Joomla.

Measured across the sites we audit, on each site's most recent snapshot.

What this check and mySites.guru tool looks at on your site

This check reads the $sef setting in your site’s configuration.php file and checks whether Search Engine Friendly (SEF) URLs are enabled.

Readable URLs rank and get clicked more

Unlike the rest of this group, this one isn’t a security issue, it’s an SEO one, and it’s worth being upfront about that rather than dressing it up as a risk it isn’t.

With SEF off, Joomla generates URLs like:

https://example.com/index.php?option=com_content&view=category&layout=blog&id=72

With SEF on, the same page becomes something like:

https://example.com/image-gallery/animals

That matters for two separate reasons. Search engines weigh a URL’s readability as part of how they rank and display a page, so a query-string URL is a small, avoidable handicap, one of several quick wins alongside checking whether your robots.txt is hurting your SEO. And human visitors are simply more likely to click, remember, or share a link they can read at a glance than one that’s a wall of parameters. Search results themselves show the difference directly: under the blue title link, Google displays the page’s URL, and /image-gallery/animals reads as a page about exactly what it says, while index.php?option=com_content&view=category&layout=blog&id=72 reads as nothing at all to a person scanning results, and tells a search engine nothing useful about the page’s topic either. On top of that, most SEO plugins, breadcrumb components, and canonical-tag conventions assume SEF is already switched on; leaving it off can quietly undermine tools you’ve already installed to help with exactly this.

SEF sits alongside two related Global Configuration settings that are worth checking at the same time, once you’re on the Site tab: URL Rewriting, which removes index.php from the URL entirely using the server’s rewrite module rather than Joomla’s own router, and Add Suffix to URL, which appends .html to give search engines an extra readability signal. Neither does anything without SEF already switched on, which is why SEF is the setting that matters most.

There’s also a cost worth knowing about if SEF has been off for a long time before you switch it on. Every internal link, every backlink from another site, and every URL already indexed by a search engine points at the old query-string address, and those need to keep resolving after the change or switching this on trades one problem (unreadable URLs) for another (broken links). Joomla’s own router handles this for you: it makes the new SEF URL the canonical one while still resolving the old query-string form behind the scenes, so existing links and bookmarks keep working rather than becoming dead ends.

Words in the URL, no trade-off attached

Search Engine Friendly URLs is set to Yes, and the site’s URLs read as words rather than query strings. There genuinely isn’t a downside to weigh here, which sets this check apart from most of the rest of this group: SEF doesn’t trade off against anything else, it doesn’t change what a visitor can see or do, and it doesn’t loosen any security setting elsewhere. The only reason a site would be running with it off is that nobody has switched it on, not that switching it on costs something.

How to fix it

  1. Login to the Joomla administration, e.g. https://yoursite.com/administrator.
  2. Go to Site, then Global Configuration.
  3. On the Site tab, under SEO Settings, set Search Engine Friendly URLs to Yes.
  4. Click the Save button.
  5. Load a few pages straight after saving, including ones a couple of clicks deep into the site, to confirm they render correctly rather than 404ing.

A small number of hosts don’t have the Apache rewrite module Joomla needs for SEF URLs to resolve correctly, and the site can stop displaying properly right after you enable it. If that happens, it’s a hosting-side limitation rather than a Joomla one, and it’s worth raising with your host rather than leaving SEF off permanently or deleting .htaccess outright, since that file usually carries other rules (redirects, security headers) that you’d lose along with it. Joomla ships a template .htaccess.txt file in the site root for exactly this reason: it needs renaming to .htaccess before URL Rewriting can do anything, which is the single most common reason SEF appears to be on but URLs still show index.php.

If the site has been running with SEF off for years before you switch it on, don’t assume the change is purely cosmetic. Anything that has recorded the old query-string URLs, an old sitemap submitted to Search Console, a backlink from another site, a bookmark a returning visitor saved, keeps pointing at the old address. As covered above, Joomla’s router still resolves those, so nothing breaks, but it’s worth resubmitting an updated sitemap afterwards so search engines start indexing the readable version rather than continuing to crawl and display the old one.

What mySites.guru does about it

mySites.guru checks every connected site for this setting and can turn Search Engine Friendly URLs on across every connected site with one click.

Search Engine Friendly URLs

mySites.guru checks every connected site for this automatically and flags it the moment it appears. These run twice a day on every connected site.

It can also fix this across every connected site with one click.

Further Reading

Frequently Asked Questions

Is this a security risk?
No. Unlike the rest of this group, Search Engine Friendly URLs is purely an SEO and usability setting. Leaving it off has no security consequence.
Why would a site stop working after SEF is enabled?
Almost always because the server's Apache rewrite module isn't enabled, or the site's .htaccess isn't being read. That's a hosting configuration issue to raise with your host, not a reason to leave SEF off long-term.