Joomla 3 end of life: what to do with your site

Where things stand

These are the Joomla project's dates, checked on 31 October 2026:

• Joomla 3: support ended on 17 August 2023, paid extended support ended on 17 February 2025;
• Joomla 4: support ended on 14 October 2025;
• Joomla 5: regular fixes until 13 October 2026, security fixes until 12 October 2027;
• Joomla 6: regular fixes until 17 October 2028, security fixes until 16 October 2029.

So a site still on Joomla 3 has three years of unpatched vulnerabilities. The risk grows with the extensions: attacks nearly always come in through an old component, and its developer has often stopped years ago.

Then there is PHP. The versions Joomla 3 runs well on no longer get fixes, and hosts are removing them. The host itself may end up stopping the site.

The three roads

Upgrade to Joomla 6

The path goes through every intermediate version: first Joomla 3.10, then 4.4, then 5.4, then 6. The core updates in a few clicks, and Joomla's pre-update check shows what isn't compatible. The real work is elsewhere: a Joomla 3 template doesn't run on 4, and every extension has to be checked or replaced.

It pays off when the site has a lot of content, users already know the admin panel and the main extensions have an updated version.

Rebuild it

If the template has to be redone anyway and the design is old too, it can be better to rebuild the site and bring the content in: on Joomla, on WordPress or custom. Redirects from the old addresses keep your Google positions.

Protect it for as long as you need

If upgrading takes months, say because of a custom component, the risk can be reduced in the meantime: tested backups, a firewall in front of the site, an admin panel reachable only from certain addresses, unused extensions removed. This is a bridge with an arrival date, and it does not make an old site safe.

How I work

1. I make a copy of the site and leave your original untouched.
2. I list version, PHP, extensions and template, and write what happens to each.
3. I propose one of the three roads, with price and timing in writing.
4. I upgrade the copy step by step, and the site goes live only after you have tried it.

After that, the site stays up to date with maintenance. If the site has already been attacked, the cleanup procedure is the one on the hacked website page, which applies to Joomla too.

Frequently asked questions

If the site works, why touch it?

Because working and holding up are two different things. A vulnerability published for Joomla 3 stays unpatched, and automated tools try old sites one by one. Sooner or later the host will also stop offering the PHP version it needs.

How long does an upgrade take?

It depends on the extensions and template more than on the pages. A simple site with few components takes a few days. A custom template or a component with no successor takes longer.

Can I stay on Joomla?

Yes. Joomla 6 is supported until 16 October 2029, and I work on its recent versions as I do on WordPress. If your team already knows the admin panel, it is often the easiest road.

Is Joomla 4 out of support too?

Yes, since 14 October 2025. Joomla 5 has received only security fixes since 13 October 2026, and will until 12 October 2027.

Read more

• The service: Website maintenance
• More pages like this: Websites with a problem