Joomla Toolkit¶

The Joomla Toolkit provides centralized management for all Joomla installations on the server. It enables installation, updates, extension and template management, security scans, automatic login, staging and much more.

Overview¶

The Joomla Toolkit displays all installations either as cards (with screenshot preview) or as a list. Two summary metrics are shown at the top: Total (number of installations) and Updates (installations with available updates).

Information	Description
Domain	Website domain
Path	Installation path relative to the document root (`/` = root)
Joomla Version	Installed Joomla version
Status	`active`, `installing` or `error`
Extensions	Count (with update notice)
Templates	Number of template styles
Staging	Marker if the entry is a staging clone

Via Scan, the panel detects existing Joomla installations on the customer's websites and registers them automatically in the toolkit.

Install Joomla¶

Click Install
Fill out the form:

Field	Required	Description
Website	Yes	Select the target website
Path	No	Subdirectory (empty or `/` = root)
Create database automatically	—	Enabled by default — the panel creates name, user and password
Database name / user / password	Manual DB only	Required if automatic creation is disabled
Website Title	Yes	Title of the Joomla site
Enable SSL	No	Requests a Let's Encrypt certificate after installation

Click Install

Note

Each Joomla installation is counted as a full website and counts against the package's website limit.

The system automatically performs:

Detection and download of the latest Joomla 5 version (official full package from GitHub)
Creation of a MariaDB database (when auto-creation is enabled)
Execution of the Joomla CLI installer with table prefix j_
Removal of the installation directory (Joomla security recommendation)

Admin account

A fixed admin user jadmin is created with a cryptographically random password. Access is convenient via Auto-Login — no manual password is required.

Click the Login button on an installation
You are automatically logged in as a Joomla Super User in the backend (/administrator/)

How it works

Auto-Login generates a one-time, cryptographically random token stored in Joomla's #__user_keys table that expires after 120 seconds. A helper script (nc_autologin.php) validates the token server-side and logs in the Super User via an internal request. No password is transmitted via the URL; a temporarily set password is automatically restored to its original value shortly afterwards.

Updates¶

Update Joomla Core¶

If a core update is available, a warning is shown in the Overview tab
Click Update Core
Before the update the agent automatically creates a compressed database snapshot (.joomla-snapshots/)
The update is performed via the Joomla CLI (core:update)

Update Extensions¶

Switch to the Extensions tab
Extensions with an available update are marked with an orange badge
Update them individually via the update icon in the row, or all together via Update Extensions

Configure Automatic Updates¶

The Overview tab (right column) provides two switches:

Switch	Description
Core	Enable automatic core updates
Extensions	Enable automatic extension updates

How auto-update works

A panel worker checks all installations with auto-update enabled every 6 hours and applies core (auto_update_core) and extension updates (auto_update_extensions). The worker only runs while the Joomla Toolkit is installed and enabled as an extension. Installations with status error and staging clones are skipped.

Extension Management¶

The Extensions tab lists all installed components, modules, plugins, templates, libraries and packages:

Column	Description
Name	Display name of the extension
Element	Technical identifier
Type	`component`, `module`, `plugin`, `template`, `library` or `package`
Status	Enabled, Disabled or Protected (core extension)
Version	Installed version
Update	Available update

Install an Extension¶

Via URL: Click Install Extension, enter the download URL of the ZIP package and select the type.
Via upload: Click Upload Extension and choose a .zip file. The package is detected and installed via Joomla's extension:discover:install.

Enable / Disable / Delete¶

The switch in the status column enables or disables the extension
Non-protected extensions can be deleted via the trash icon

Protected extensions

Core extensions marked as protected can neither be disabled nor deleted.

Template Management¶

The Templates tab shows all template styles with title, technical name and client (Site or Administrator). Via Activate, a style is set as the default for its client.

Database¶

The Database tab offers three actions:

Action	Description
Optimize Database	Runs an optimization of the Joomla tables
Export Database	Downloads a SQL dump as a file
Import Database	Imports a `.sql` or `.sql.gz` file

Security¶

The Security tab combines three tools:

Reset Admin Password¶

Sets a new random password for the Joomla admin and displays it once.

Security Scan¶

The scan checks the installation and returns a Score plus a list of findings with status (pass, warn, fail). Checks include:

configuration.php permissions
configuration.php writability
Information disclosure via .htaccess
Enabled FTP layer
Leftover installation directory

Harden¶

Via Harden or the per-finding Fix button, detected issues can be resolved automatically (fix permissions, remove .htaccess info, secure the configuration, disable the FTP layer, remove the installation directory).

Users¶

The Users tab lists the Joomla user accounts (ID, username, name, email, group). Users can be created (name, username, email, password, user group from Registered to Super Users) and deleted.

Additional Settings (Overview tab)¶

Setting	Description
Clear Cache	Clears the Joomla cache
Backend Language	Changes the language of the administrator interface
Offline Mode	Puts the website into maintenance mode
Debug Mode	Enables Joomla's debug output

Page Cache (FastCGI)¶

Like the WordPress Toolkit, Joomla sites can enable a FastCGI micro-cache: Nginx briefly caches finished PHP responses (30 s) and serves repeat requests without PHP.

Enable: the Page Cache (FastCGI) switch on the installation. Automatically bypassed are POST requests, /administrator, and requests carrying a Joomla session cookie — so a private page is never served to the wrong visitor. The X-Enconf-Cache header shows HIT/MISS/BYPASS.

Joomla with front-end login

Because Joomla sets a session cookie for every visitor, the micro-cache mainly caches cookie-less first hits on Joomla. The gain is largest for info/brochure sites; for member/login areas the bypass is deliberately conservative.

Joomla CLI¶

In the CLI tab, Joomla CLI commands can be run directly. Enter a command and click Run — the output is displayed below.

Staging¶

For non-staging installations, a staging area is available in the Overview tab.

Click Create Staging and enter the target URL (e.g. https://staging.your-domain.com)
The panel clones files and database into a separate environment
Via the staging card you can open the site, log in via Auto-Login, or delete it

Push Changes Live¶

Click Push to Live and choose whether files and/or the database should be synchronized.

Caution when pushing live

Pushing a staging environment live overwrites the production files and/or database. Review the selection carefully before confirming.

Migration (Import)¶

Via the cloud-upload icon on an installation, an existing Joomla site can be imported from another host:

Enter the old URL and the new URL (for automatic URL replacement)
Provide the database credentials of the target installation
Upload the backup archive (.zip or .jpa)

The system extracts the archive, imports the database and adjusts the URLs.

Uninstallation¶

Click the Delete icon
Enter the website's domain to confirm
Confirm with Permanently Delete

Database removal

Deleting removes the Joomla files. Automatically created databases are only dropped if no other Joomla installation remains on the same website.