Joomla

Joomla 6.x ships about 18 custom field plugins (text, list, media, subform, sql, user, url, calendar and others), with audio, video and document media fields added in 6.1, attachable to articles, contacts, users and categories. There is still no way to define a fully custom content type in core, and no schema-as-code, so modeling bends articles plus fields rather than creating new types. Higher would need custom types; lower would ignore the reasonably broad field set and subforms.

Relationships in core are expressed through categories, tags, menu items and language associations; custom fields have no item-reference type that points from one article or contact to another. There is no reverse traversal or many-to-many modeling outside tags. Scored just above the floor because tags and categories do connect content across components.

Subform fields allow repeatable, nested groups of fields and 6.1 added a responsive grid layout for them, which gives some structured composition. Body content is still a single HTML field edited in TinyMCE, with no block or component system and no portable rich text. Below 40 because composition is limited to subforms on top of an HTML blob.

Editors can mark custom fields required, set input filters (raw, safehtml, alnum, integer) and use showon conditional display; developers can add FormRule classes (email, url, tel, regex, custom) in form XML that apply to both admin and API saves through the shared model layer. There is no UI-level regex, min/max or cross-field rule builder for site builders. Slightly above the previous reading because the developer-side rule system is extensible.

com_contenthistory keeps versions for articles, categories, contacts, tags, custom fields and (since 6.1) modules, with side-by-side compare, version notes, keep-forever flags, author attribution and one-click restore; trashed items can be restored from the Trash state. Retention is a count limit, there is no branching or release model and no versioning API. Upper part of the adequate band.

Joomla ships two native taxonomies: nested categories per component and nested tags shared across articles, contacts, categories and other components, both governed by ACL (who may create or edit terms), exposed through the Web Services API and bulk-reassignable through the Batch tool. Every item carries meta description, robots and author metadata. No synonyms, controlled vocabularies beyond tags, or asset metadata schemas keep it below 75.

Logged-in editors with permission get edit icons on the live frontend for articles and, when enabled in Global Configuration, for modules and menus, which open the edit form in the site context; the backend Preview button renders the article in the site template. Edits happen in a form rather than inline, there are no shareable preview links for unpublished content and no headless preview support. Mid-limited band.

TinyMCE 8 (since 6.0) provides full WYSIWYG formatting, paste cleanup and table editing, and the editors-xtd buttons embed articles, images, modules, custom fields, menu links and page breaks. Output is an HTML blob with shortcodes-style embeds, not a portable structure. Standard WYSIWYG band.

com_media offers upload, folders, an in-browser image editor (crop, resize, rotate), WebP and AVIF acceptance and filesystem adapters, plus alt text entry when images are inserted. There is no focal point, no URL-based transforms or format conversion, no responsive srcset generation and no usage tracking. Basic upload-and-serve band.

Joomla prevents conflicts with check-out locking, which is better than last-write-wins, but there is no presence, commenting, mentions or co-editing in core. Workflow transition notifications are the only collaborative signal. Below the locking-plus-commenting band because there is no commenting at all.

com_workflow provides custom stages and transitions assignable per category, transition-level ACL, email notifications on transitions, and an audit trail through User Actions Log; 6.1 added a visual graph editor for stages and transitions. There is no task assignment to named users, no due dates and no parallel or conditional routing. Upper half of the multi-step approvals band.

Every article, module and many other items have native Start Publishing and Finish Publishing dates, plus featured start and end dates, evaluated at query time with user timezone support and settable through the API. There are no release bundles and no publishing calendar view. Scheduled publish and unpublish without bundles sits in the 60 to 74 band.

Joomla's native multilingual system assigns a language to each item, links translations with Associations (with a side-by-side associations manager), and uses per-language menus, a language filter plugin and a language switcher; 6.1 extended associations to modules. Localization is document-level with an 'All languages' option rather than fallback chains, and there is no field-level localization. Document-level band.

Joomla's ACL supports custom user groups and viewing access levels with inheritance down to component, category and item level, separate create, edit, edit own, edit state and delete actions, and per-field edit permissions on custom fields; core authentication covers LDAP and MFA (TOTP, WebAuthn). There is no SAML or OIDC SSO and no SCIM in core, and 2026 saw a string of ACL-check security advisories. Good role model, so mid-upper 45 to 65 band.

The Web Services API follows JSON:API v1.0 with token authentication and covers articles, categories, contacts, tags, users, menus, modules, languages, media, fields and more, with basic filtering, sorting and pagination and a language filter. It is REST only, delivery and management share one authenticated API, and filtering is shallow. Below the well-designed REST band.

Joomla is self-hosted with page and conservative caching plus a lazy-load plugin; CDN delivery is left to the host or a third-party extension. No purge integration or edge features in core. Self-hosted without CDN band.

Core has no outbound webhooks; the 6.1.4 plugin tree has no webhooks group and the task scheduler's Requests task only issues scheduled GET calls. The internal event system (onContentAfterSave, workflow and user events) is rich, so custom plugins can emit webhooks, and JED extensions provide them. Basic band because nothing ships out of the box.

The JSON:API layer makes headless delivery technically possible, but there are no official SDKs and article bodies are HTML blobs that tie content to the web. A traditional CMS with an API added, held below 50 by the lack of SDKs and portable output.

Joomla 6.x has user groups and viewing access levels, which separate logged-in audiences but are not behavioral or rule-based segments, and there is no customer profile store or CDP connector in core. Nothing in the 6.1 or 6.2 release notes adds segmentation. Absent as a capability.

Core can show or hide content by access level, user group and language, which is identity-based visibility rather than segment-driven variants. Rule-based content variants come from JED extensions such as Regular Labs Conditional Content. No variant model or per-audience preview in core.

There is no experimentation in Joomla core; A/B testing comes from external tools such as VWO through JED extensions or script injection. No traffic allocation or results reporting inside the CMS.

The core Articles - Related module matches content by shared tags or keywords, and category and tag modules give editorial curation. There is no algorithmic or behavioral recommendation engine. Manual curation band.

Smart Search (com_finder) ships in core with an indexer, stemming, autocomplete suggestions, taxonomy-based search filters, weighting multipliers for title and body, and search statistics, and its plugin API indexes any extension's content. No typo tolerance, merchandising or external engine connector in core. Basic-to-solid native search.

Core has no catalog, cart or checkout, but mature Joomla-native commerce extensions (VirtueMart, HikaShop, J2Commerce) add full storefronts with cart, checkout, pricing and inventory. Delivered through the extension directory, so capped as integration.

Connectors to external commerce platforms such as Shopify or commercetools are limited to small JED extensions or buy-button embeds; there is no product picker or live product federation in core. Low integration band.

Core tracks article hit counts, Smart Search statistics and User Actions Log entries, which are operational rather than content-performance analytics. No engagement or content-health reporting.

GA4 and Google Tag Manager are added through JED extensions or template script fields; core has no analytics integration layer or event helpers. Marketplace connectors only.

One Joomla installation serves one site; multiple sites need separate installations, or a JED multisite extension. No shared content or central governance across sites in core.

Translation in core is manual through Associations; no TMS connectors, machine translation hooks or translation memory ship with Joomla. Some JED extensions add XLIFF export or machine translation.

Joomla has no multi-brand or multi-tenant concept; brands would run as separate installations with no shared policy enforcement.

com_media is a folder-based library with basic image editing; it has no asset metadata schemas, taxonomy, versioning, rights or approvals. Basic library band.

Joomla 6.1 added audio, video and document media custom fields so files can be uploaded and rendered with the HTML5 player. There is no transcoding, adaptive streaming or caption management. Just under the basic-upload band.

Core layout is template positions plus module assignment and template overrides, edited through forms. Full drag-and-drop builders (YOOtheme Pro, SP Page Builder, Quix) are mature third-party products widely used on Joomla. Scored inside the integration ceiling for that ecosystem.

Joomla renders the full site natively (Cassiopeia template, SEF routing, overrides, child templates) and the customer hosts it; the project documents server requirements and offers a free trial site through Launch Joomla, but no managed production hosting. Renders natively, customer hosts.

Core ships only the contact form in com_contact plus captcha (including the 6.x Proof-of-Work captcha). Full form builders with conditional logic, multi-step forms and integrations come from mature JED extensions such as Convert Forms, RSForm!Pro and ChronoForms.

Core offers mass mail to user groups and mail templates; newsletters and ESP sync come from extensions such as AcyMailing, Mailjet and Brevo's Joomla integration. Basic-to-solid connector band.

No marketing automation in core; AcyMailing automations and the Brevo integration add triggered sequences through extensions. No lead scoring or lifecycle stages tied to CMS events.

Core provides per-item meta description and robots, SEF URLs with rewriting and alias governance, the Redirects component (301s, 404 capture, bulk import), hreflang alternates through the language filter plugin and native Schema.org (JSON-LD) authoring plugins for types such as Article, Event, Organization and Recipe. There is no core XML sitemap generator and no on-page SEO recommendations. Native metadata, redirects and structured data, minus sitemaps.

Native JSON-LD helps citation, but Joomla 6.1 has no llms.txt generation, Markdown endpoints or per-bot crawler controls as far as available evidence shows; site owners edit robots.txt by hand. Not much beyond standard SEO.

The official Joomla Extensions Directory lists over 6,000 extensions across all categories with one-click install from the backend, though the share certified for 6.x is smaller and quality varies. Solid marketplace band.

Joomla natively supports visitor registration, login, profiles and password reset, MFA for site users, access-level gated content and menus, and a privacy component for consent, data export and deletion requests. Social login, OIDC and SAML federation require JED extensions, so there is no native CIAM federation. Upper part of the gated-content band.

Joomla 6's Web Services API follows the JSON:API v1.0 specification with consistent response formatting, bearer-token HMAC auth, error handling, and pagination, and manual.joomla.org publishes versioned docs (6.1 current, 6.2 upcoming). The JoomlaLABS webservices-documentation component now auto-generates an OpenAPI 3.1.0 spec plus interactive Swagger UI/Redoc from installed components for J6.0+, closing the interactive-playground gap — but it is a community add-on, not core, there is no GraphQL in core (only a POC), and extension endpoint coverage is inconsistent. Small bump for OpenAPI 3.1.0 generation and interactive docs; the core API remains bolted-on rather than API-first.

Joomla 6.1 introduced plugin lazy loading — plugins load only when an event calls them — measurably reducing server response times and peak memory, which benefits API request handling. Still no published rate limits, no API benchmarks, no batch operations, and no CDN-backed delivery layer; performance remains entirely dependent on self-managed hosting. Small bump retained for the lazy-loading improvement only.

No official client SDKs for the Joomla API in any language as of Joomla 6.1 — developers use raw HTTP against the JSON:API endpoints. Generic JSON:API client libraries work but nothing Joomla-specific or type-safe exists, and no code generation tooling. Unchanged through the 6.x branch.

The Joomla Extensions Directory now displays Joomla 6 compatibility badges and the 2026 JED Checker rewrite enforces J6 coding structure and mandatory update servers — a governance improvement for patch delivery. But 2026 exposed acute quality risk: critical unauthenticated RCEs in three of the most-installed extensions (JCE CVE-2026-48907, SP Page Builder CVE-2026-48908 CVSS 10.0, Page Builder CK CVE-2026-56290 CVSS 10.0) were actively exploited, several added to CISA KEV. Thousands of extensions exist across all major categories, but the long tail keeps shrinking and the security quality floor is low; the marketplace is stabilizing around J6 yet remains contracted and uneven.

Joomla 6 retains the mature five-type extension architecture (components, modules, plugins, templates, languages) with namespaced code, dependency injection, service providers (services/provider.php), and PSR-12 standards; 6.1's event-driven lazy loading modernizes the plugin lifecycle. Custom field types (including new audio/video/document media fields in 6.1), server-side hooks, and custom admin UI are all possible. Powerful but requires deep PHP and Joomla MVC knowledge — no low-friction app framework.

Joomla 6 ships native MFA and WebAuthn/passkeys in core, LDAP via plugin, token-based API authentication, and 6.1's invisible proof-of-work CAPTCHA. But MFA enforcement failed twice in two months: 6.1.3 fixed an MFA authentication bypass [20260807] and 6.1.4 (2026-09-29) fixed a second MFA bypass via rememberme cookies [20260914], alongside an unauthorized account-creation flaw in the profile.save controller [20260902]. SAML and OIDC SSO still require third-party extensions, so it sits below the 60-75 band for platforms with native SSO.

Joomla 6's ACL is still one of its strongest features: permissions at global, component, category and item level, custom inheriting user groups, and 6.1's visual workflow editor. Enforcement keeps breaking, though. 6.1.3 and 6.1.4 fixed a long list of improper ACL checks in the web services API (mutating endpoints, custom fields, categories, access levels, various edit tasks) plus workflow stage changes, batch copy, tagged-item output and content history comparison. The model is sound, but the API layer does not reliably apply it. No field-level permissions, and the permissions matrix remains confusing.

As self-hosted open-source software, Joomla 6 carries no platform-level certifications — no SOC 2, no ISO 27001. GDPR tooling (privacy consent, data export/deletion requests) remains in core, a notable positive. Enterprise compliance posture is entirely the implementer's infrastructure responsibility, structural to all self-hosted OSS.

2026 has been Joomla 6's worst security year. After the critical com_users privilege escalation (CVE-2026-48898, CVSS 9.8, actively exploited and added to CISA KEV) patched in 6.1.1, 6.1.3 (August) carried 10 core advisories and 6.1.4 (2026-09-29) another 16: two MFA bypasses, unauthorized account creation, arbitrary directory deletion via cache purge, SSRF vectors, SHTML upload, CORS validation and several XSS filter bypasses in InputFilter. Most are rated Moderate, and the Security Strike Team discloses responsibly and patches quickly; 5.4.9 and 6.x also added a security-release flag to extension update XML. Still, 26 core advisories in two months, on top of actively exploited CVSS 10 RCEs in top extensions, puts the track record well below baseline.

Joomla 6 is self-hosted only with no official SaaS offering; it runs on standard LAMP/LEMP (PHP 8.3+, MySQL 8.0.13+/MariaDB 10.4+), has an official Docker image (php:8.3-apache and 8.4 variants), and works with virtually any managed PHP host. Automatic core updates (since 6.0) reduce maintenance burden. Per the rubric, self-hosted-only flexibility lands at 65–75; modest requirements keep it solidly in that band but the absence of any vendor-managed option caps it at the low end.

No platform SLA exists — uptime is entirely determined by the implementer's hosting infrastructure, and there is no status page for Joomla as a service. Incident communication is limited to software security announcements. Expected for self-hosted platforms, but a significant gap versus SaaS competitors.

Joomla 6.1's plugin lazy loading delivers genuinely lower peak memory and faster responses, and the 6.x caching layer is improved — but the platform remains a PHP monolith with no auto-scaling, no application-layer multi-region support, and no documented scale limits or enterprise-scale references. Scaling is achievable with infrastructure investment (load balancers, replicas, caching) but the architecture is not designed for horizontal scale. Small bump retained for the measurable 6.1 performance work.

Backup is self-managed, but Akeeba Backup is a mature de facto standard covering full site and database snapshots, and content in standard MySQL/MariaDB ensures portability. No documented RTO/RPO from the project and no built-in automated backup in core. Automatic core updates help patch currency but don't address DR.

Joomla 6 runs locally via the official Docker image with live folder mounts, docker-compose recipes documented in the guide.joomla.org user manual, the Lando plugin, or classic XAMPP/MAMP; core development uses Composer and NPM. The Joomla CLI handles basic operations but offers no scaffolding, hot reload, or environment-parity tooling. Local dev works because it's standard PHP, not because of dedicated tooling.

No built-in environment management, no schema/content migration CLI, no deploy previews, and no branch-based environments in Joomla 6. An open joomla-cms discussion (#35582) on updating Joomla via CI/CD pipelines confirms the gap — the community explicitly requests a repeatable CLI migration system that core does not provide. Deployments remain manual or built on generic tooling (Git, rsync, Docker).

Documentation has consolidated meaningfully for 6.x: manual.joomla.org publishes versioned developer docs (6.1 current, 6.2 upcoming) maintained on GitHub, guide.joomla.org provides a structured user manual including migration and local-setup guides, and api.joomla.org covers the CMS 6.0.x API reference. Coverage is still incomplete in places, code examples are uneven, and there is no core interactive playground or framework-specific getting-started guides. Bump retained for the versioned, restructured doc portals.

Joomla 6 is a PHP platform with zero TypeScript support: no official SDKs in any language, no type generation from content schemas, and an admin interface being migrated to plain VueJS (not TypeScript). Consuming the JSON:API from a TypeScript frontend requires hand-writing every type. Unchanged in the 6.x branch.

Q3 2026 kept the predictable cadence: 6.1.3 shipped Aug 18 and 6.1.4 Sep 29 (both security/bugfix, with 5.4.8/5.4.9 in parallel), while 6.2.0 went Beta 1 (Aug 18), Beta 2 (Sep 1), Beta 3 (Sep 15) and RC1 (Sep 29) exactly on its published dates, with GA set for Oct 13. Merged PR volume dipped from 282 in Q2 to 172 in Q3, consistent with the feature freeze. Feature shipping still comes in six-monthly minors rather than SaaS-style continuous delivery, which caps the score.

Release announcements are well structured: the 6.1.4 notes list all sixteen numbered security advisories [20260901]-[20260916], the full merged-PR list with authors, milestone links, and a known-issue section linking to a dedicated manual page with the workaround. The 6.2 RC links a new 6.1-to-6.2 migration guide and a 'potential backward compatibility issues' page. Still no machine-readable changelog or per-item breaking/non-breaking tagging, which keeps it below the 75+ band.

The public roadmap published every 6.2 milestone in advance and the project hit all of them, including the two extra betas and RC1 on Sep 29, extending a multi-release on-time record. It also publishes branch lifecycle dates (6.x bugfix support to Oct 17, 2028, security to Oct 16, 2029; 5.x security to Oct 12, 2027) and a forward product strategy for 7.x (multisite, rate limiting, MCP/AI framework). No community voting portal, and the 7.x plans are direction rather than dated milestones, which keeps it below 70.

6.x minors defer breaking changes to the next major per the published development strategy, 6.2 ships with a dedicated migration guide and a backward-compatibility issues list, and 5.x keeps security support until Oct 2027, giving a year of overlap after 5.x bugfix support ends in Oct 2026. The Backward Compatibility 6 plugin still lets J5 extensions run. Behaviour-tightening ACL fixes land in patch releases out of necessity, and there are no codemods or automated migration tooling, which keeps it mid-range.

GitHub is flat at ~5.1K stars and ~3.9K forks on joomla/joomla-cms. W3Techs now puts Joomla at 1.1% of all websites and 1.6% of the known-CMS market, down again from 1.2%/1.7% in July 2026, and only 8.9% of Joomla sites run 6.x while 52% remain on Joomla 3. The forum and extension counts are still large, but the active 6.x user base is a small slice of a shrinking total.

Contribution is steady but thin: 172 PRs merged in Q3 2026, and the 6.1.4 release credits a broad spread of individual contributors for bug fixes. GSoC 2026 projects continue, the Joomla World Conference runs in Potsdam Oct 16-18, and an outside security firm (mySites.guru) has run a sustained disclosure program across the extension ecosystem. The core maintainer group remains small and Stack Overflow activity keeps declining.

Joomla has a Service Providers Directory, an official Partners page and a formal certification program (Administrator exam in six languages, public certified-user directory, Learning Partners network). The certification is stale, though: its exam spec still reflects the Joomla 3-era template and sittings only happen at Learning Partners, JoomlaDays and user groups. No major SIs list Joomla as a practice area, so buyers get freelancers and small agencies rather than a structured partner tier.

The 6.1.x releases continue to generate third-party coverage (mySites.guru, Joomill, db8 walkthroughs and migration/security guides), and the Joomla Community Magazine publishes regularly. However, mainstream tech education platforms (Udemy, Pluralsight) have minimal current Joomla content, and sustained output remains far below WordPress, Drupal, or headless platforms.

ZipRecruiter and SimplyHired list a few dozen to ~120 Joomla developer roles, and freelance platforms (Upwork, Toptal, Fiverr) keep active Joomla pools. The official Administrator certification exists but is dated and not a live Joomla 6 credential, so it does little to signal current-version skills. Talent is mostly freelance and contract rather than full-time enterprise roles.

W3Techs shows share falling again to 1.1% of all sites and 1.6% of the CMS market in September 2026, and a year after 6.0 GA only 8.9% of Joomla sites run 6.x while more than half remain on end-of-life Joomla 3. No notable new enterprise logos surfaced in 2026. The 6.x releases serve retention of the existing base, not new adoption.

Open Source Matters' FY2026/27 budget projects only ~$10K of income, roughly 85% below two years earlier after sponsorship revenue collapsed, following a ~$49K loss in FY2025/26; reserves of ~$205K give about four years of runway and OSM says it has no team driving fundraising. A Sovereign Tech Fund investment (20-month audited WCAG 2.2 accessibility programme, started Jul 1, 2026) and Digital Public Good recognition are real positives, but that money is restricted and does not fix the general-fund shortfall. Community ownership means no acquisition risk.

Joomla is absent from Gartner MQ and Forrester Wave evaluations and keeps losing share to WordPress, Drupal and headless platforms, now 1.6% of the CMS market. Digital Public Good status and the Sovereign Tech Fund backing give it an emerging public-sector and digital-sovereignty angle, but that has not yet translated into market positioning or analyst attention.

G2 holds at 4.0/5 on roughly 390 reviews, with slow review growth. Reviewers praise flexibility, permissions and built-in multilingual support, and keep citing a steep learning curve, a dated admin and stressful upgrades when many extensions are installed. G2 4.0 maps to the 45-60 band and these recurring complaints keep it at the bottom.

Joomla 6.x is free and open source under GPL v2+. Zero licensing cost, no tiers, no hidden fees — the pricing model is maximally transparent at $0 for the software. All costs are hosting, development, and maintenance, fully within the buyer's control.

Free software scales perfectly in licensing terms — no per-seat, per-API-call, or usage-based charges. Unlimited users, content, and API calls. Only hosting infrastructure and development labor scale with usage, making this the most predictable pricing model available.

All core features ship in the free open-source distribution — no premium tiers, no enterprise-only features, no upsell gating. Joomla 6.1 added Proof-of-Work CAPTCHA, Visual Workflow Editor, and Media Custom Fields, and 6.2 (RC1 Sept 29, 2026) adds multi-category assignment and language fallback chains, all free in core. Some third-party extensions are commercial, but the core platform has zero feature restrictions.

No vendor contracts — download and use freely under GPL. No annual commitments, no exit clauses, no lock-in periods. Hosting contracts are independent and switchable at any time. Maximum flexibility inherent to the open-source model.

Joomla is fully free GPL software with no usage limits or commercial restrictions. launch.joomla.org provides free hosted sites for instant evaluation (subdomain only, monthly login renewal), and self-hosting on shared hosting runs $1-5/month. The hobby path delivers full platform capabilities at near-zero cost.

launch.joomla.org and CloudAccess deliver a working site in seconds, and one-click installers on shared hosting take minutes — first published content is achievable within an hour. However, customization to production quality takes days to weeks: template selection, extension configuration, and content modeling add significant time before a real project delivers value.

Simple Joomla sites can be built in 2-4 weeks; medium complexity with custom templates and extensions takes 1-3 months; complex sites with custom components run 3-6 months. Comparable to other traditional CMS platforms but longer than modern headless projects. 2026 project budgets range from ~$1,000-5,000 for basic sites to $80,000+ for large custom portals.

Base Joomla rates are moderate (~$48/hr US average), but the premium is driven by talent scarcity rather than platform complexity. W3Techs now puts Joomla at 1.6% of the CMS market (down from ~1.9% in 2025), and migration outflow to WordPress outnumbers inflow roughly 5:1, so the experienced 6.x developer pool keeps shrinking. General PHP developers can learn Joomla, but finding senior 6.x extension developers is getting harder, which offsets part of the zero licensing cost.

Joomla 6.x runs on cheap shared hosting — basic sites cost $1-5/month on a standard PHP + MySQL/MariaDB stack. CloudAccess.net offers a free tier and low-cost managed Joomla plans, and managed VPS options like ScalaHosting start near $15/mo; higher-traffic sites run fine on $20-100/month VPS/cloud hosting. Hosting costs are among the lowest of any CMS; the trade-off is self-managed infrastructure unless using a managed provider.

Self-hosted means full ops responsibility — updates, security patches, backups, monitoring, server maintenance. Every 6.1.x patch release has been a security release, and September 2026 alone required two (6.1.3 and 6.1.4, the latter fixing XSS, ACL bypasses, arbitrary directory deletion and SSRF), while 6.2's Web Services intro/fulltext field split will require API client updates. Automatic minor-version updates help, but the patch cadence and limited managed-hosting ecosystem (CloudAccess vs Drupal's Acquia/Pantheon) keep ops burden above a typical traditional CMS.

Content is stored in MySQL, accessible and exportable, and the Web Services API provides programmatic content access. Migration tooling is mature: FG Joomla to WordPress is actively maintained and tested through Joomla 6.x, and LitExtension/CMS Minds offer professional migration services. However, content uses Joomla-specific table structures requiring transformation, and third-party extensions create proprietary data structures — lock-in is moderate.

Joomla 6.1 retains the same conceptual model: articles, categories, menus, modules, components, plugins, templates, and ACL levels are all distinct concepts a developer must learn, and the 6.1 visual workflow editor is one more. The menu-content relationship remains confusing for newcomers. More complex than WordPress, simpler than Drupal; 6.1.3 (Aug 2026) and 6.1.4 (Sep 29, 2026) were security and bugfix releases with no conceptual changes.

manual.joomla.org covers getting started, local environment setup, a module development tutorial as the recommended entry point, and 5.4→6.0 and 6.1→6.2 migration guides. A formal Joomla! Certification Program does exist (certification.joomla.org, Administrator exam in six languages, Learning Partners network), which earlier runs wrongly scored as absent, but it is an admin-level exam whose spec is still Joomla 3 era and there is no developer track. With no interactive tutorials, sandbox, or in-app onboarding, this stays in the docs-only band, now at its upper end.

Joomla 6.x uses modernized PHP with namespaces and dependency injection as standard, but remains Joomla-specific MVC rather than Symfony or Laravel, and template development requires Joomla-specific knowledge. The built-in Web Services REST API enables headless use with React/Next.js, but integration is community-documented rather than first-class. Skills transfer partially from modern PHP; 6.1.3 and 6.1.4 changed nothing here.

Joomla provides the Cassiopeia default template and sample data for quick starts, plus extension scaffolding guidance in the developer manual. No official framework starters exist (no Next.js, Nuxt, or Astro), no TypeScript boilerplates, and the core CLI has no scaffolding command; headless starters remain community efforts. Community-only per the rubric.

Global Configuration has reasonable defaults, and the built-in Proof-of-Work CAPTCHA removes the need for an external spam service account. Setup is more automatable than prior runs credited: the core CLI (php cli/joomla.php) ships config:get/config:set, extension:install, site:down/up and update commands, so provisioning can be scripted. Still no config-as-code or env-var driven configuration in core, configuration.php remains the environment mechanism, and per-component options add GUI surface.

Media custom fields accept audio, video and document types, adding custom fields to content remains low-risk, and 6.0 added Date/Datetime fields. Schema evolution for custom components still needs manually managed SQL update files with no migration tooling, and the core article-category-menu model is rigid next to headless CMSs. Multi-category assignment is in the 6.2 release candidate but not shipped in 6.1.

Coupled editing is solid: module versioning, the drag-and-drop workflow editor, view transitions and TinyMCE 8. There is no headless preview API, no deploy previews, and front-end preview of unpublished articles still depends on a logged-in session, which caps the score for decoupled builds. The signed-token PreviewTokenService that would fix this is in 6.2 RC 1 (Sep 29, 2026) and is not yet in a stable release, so it is not credited.

PHP developers can learn Joomla basics fairly quickly, and 6.x namespaces and DI make patterns recognizable to modern PHP developers. Advanced extension work still needs Joomla-specific MVC, the event system and ACL, which takes weeks to months to master. The existing certification is an optional, dated Administrator exam and is not required, but Joomla experience remains essential.

A solo developer can build and deploy a complete Joomla 6 site: the coupled architecture means one person covers frontend and backend on standard LAMP hosting. Production sites typically run with 2-3 people. Patching load is heavy for a small team, with security releases 6.1.3 (Aug) and 6.1.4 (Sep, 16 advisories) plus a 2026 wave of actively exploited third-party extension CVEs, so this stays at the low end of the 60-70 band.

Content authors can create and publish articles, manage media, and self-serve for routine operations. The 6.1 visual workflow editor lets content teams design publication pipelines themselves, and multilingual module associations cut developer involvement on multilingual sites. New page layouts, template changes and complex ACL configuration still need a developer; 6.1.3 and 6.1.4 changed nothing here.

TUF-secured automatic minor updates have now carried the branch from 6.0.x through 6.1.4 (Sep 29, 2026), and 6.1.3 (Aug 18) added clearer error messages for update-server problems on top of 6.1.2's update-installation and CSS-compatibility fixes. Community guidance still recommends confirming extension compatibility before enabling auto-updates, and the 5→6 move stays a manual upgrade leaning on the Backward Compatibility 6 plugin. Not higher because cross-major extension breakage persists and there are no codemods.

The Security Strike Team keeps shipping clear, numbered advisories with same-day 5.x backports, but the load on operators rose: 6.1.3 (Aug 18) fixed ten issues including an MFA bypass and inconsistent webservice ACL checks, and 6.1.4 (Sep 29) fixed sixteen more, including further webservice ACL gaps, SSRF vectors, arbitrary directory deletion via cache purge and a fourth core MFA bypass in a year, showing 6.1.3's webservice fix did not hold. Extension-side exploitation stayed intense, with more CISA KEV entries (iCagenda, Balbooa Forms, Jul 10) and a 19-vulnerability third-party disclosure run through August. Lowered because patching is now near-continuous across core and extensions; not lower because core fixes land fast and auto-updates shorten the exposure window.

The parallel release strategy continues, with 5.4.8 and 5.4.9 shipping alongside 6.1.3 and 6.1.4, and the Backward Compatibility 6 plugin keeps Joomla 5 extensions working through the whole 6.x cycle before removal in 7.0. As open-source self-hosted software, no vendor can force an upgrade on its own timeline. Not higher because unsupported branches quickly become security liabilities given the pace of core advisories, and most of the install base still sits on long-unsupported versions.

The core stack stays conventional and maintained: PHP 8.3+ (8.4 recommended), MySQL 8.0.13+ and Composer-managed libraries that are bumped in point releases (6.1.3 moved joomla/filesystem to 3.3.0). Lowered because the third-party extension graph grew into a larger liability: after July's CISA KEV RCEs in JCE, SP Page Builder and Page Builder CK came iCagenda and Balbooa Forms, plus mySites.guru's disclosure of 19 flaws across 17 popular extensions, so operators must track extension patches entirely outside the core update channel. Not lower because the runtime dependencies themselves are simple and stable.

Joomla 6 core, through 6.1.4 and the 6.2 release candidate, still ships no monitoring, health-check endpoint or observability features. The free Health Checker extension from mySites.guru and third-party healthcheck plugins fill part of the gap, but production monitoring still means standard LAMP tooling configured by the operations team. Not higher because nothing is built in; not lower because credible free ecosystem tooling exists.

Core gives editors useful hygiene levers: scheduled unpublishing via publish-down dates, the 6.1 visual workflow editor, module versioning, Global Check-in for stale locks and multilingual associations. There is still no automated orphan detection, broken-link scanning or content health dashboard in core, so most governance relies on editorial discipline. Lowered to match the rubric, which reserves 60+ for automated hygiene tooling that Joomla does not ship.

Performance still depends on standard PHP tuning: opcode caching, query optimization, CDN setup and Joomla cache plugins. 6.2 RC 1 (Sep 29, 2026) brings the access-rule preloading and article-list index work previewed in the alphas, plus WebP conversion, but GA is not until mid-October. Not higher because there is no automatic optimization or built-in performance monitoring, and those gains are not yet in a stable release.

The Joomla project offers no commercial support. Help comes from community forums, Stack Exchange or third-party agencies, with no SLA, guaranteed response time or escalation path, and Open Source Matters' shrinking income leaves no prospect of one. Not higher because there is no formal support channel to evaluate.

The community remains active and organized: busy release threads on the official forum, Joomla Stack Exchange, volunteer testers on every RC, and an independent security community (mySites.guru) running coordinated extension disclosures and publishing a disclosure standard for extension developers. It is smaller than its historical peak, and much circulating help still targets older versions, so 6.x-specific answers are thinner. Not lower because core volunteers stay dedicated and responsive.

Cadence stayed on schedule: 6.1.3 (Aug 18) and 6.1.4 (Sep 29) each followed release candidates and shipped with 5.x backports, while 6.2 moved through Beta 1 (Aug 18), Beta 2, Beta 3 and RC 1 (Sep 29) on its published roadmap, with a long list of bug fixes in each point release. Not higher because some fixes do not hold (6.1.4 reopened webservice ACL issues 6.1.3 said were resolved), and non-security fixes wait for the next scheduled release.

No visual page builder in Joomla core. Landing page creation requires template customization and module arrangement. SP Page Builder (actively maintained for Joomla 6 — v6.6.2 released June/July 2026, a critical zero-day emergency fix on top of the 6.6.0 dynamic-content feature line), Quix, and JA Page Builder add drag-and-drop page building, but these are third-party extension dependencies. Without extensions, creating marketing landing pages requires developer involvement. Marketer self-service is not possible in core Joomla. Joomla 6.1.2 (July 2026) is a security/bugfix release with no landing page additions.

No campaign management features in Joomla 6.1.x. No content calendaring, no multi-channel scheduling, no campaign analytics. Scheduled publishing exists at the article level (publish up/down dates), but there is no campaign concept. jInbound (third-party) provides landing pages and lead nurturing but is not a native capability. Marketing teams would need external tools for campaign coordination. Joomla 6.1.2 adds no campaign features (security/bugfix only).

Joomla has solid built-in SEO capabilities. Meta title and description are configurable per article and menu item. SEF URLs are built in. Redirect management exists as a core component (com_redirect). Canonical URL handling exists. Notably, Joomla ships a native frontend Schema.org structured data system — the System — Schema.org plugin plus content-type sub-plugins (Article, BlogPosting, Event, Organization, Person, JobPosting, Recipe, etc.) inject JSON-LD into frontend pages without a third-party extension (introduced in Joomla 5, carried into and actively maintained in 6.x; issue #47444 tracks a 6.2 Schemaorg image-handling improvement). This closes a gap flagged in prior scoring. Remaining gaps: sitemap generation still requires an extension, and OG/Twitter card meta tags require SEO extensions (4SEO, EFSEO). The SEO foundation is now genuinely competitive but still short of a fully built-in suite. Joomla 6.1.3 and 6.1.4 (Aug/Sep 2026) patched XSS and ACL issues in the Schema.org output and made Schema.org logo URLs absolute (#46860). These are fixes, not new SEO features, so the score stays the same. Joomla 6.2 is at RC1, with stable due about 13 October 2026, and is not scored.

No built-in form handling beyond basic contact form. Joomla 6.1 added a native Proof-of-Work CAPTCHA (PR #46514) — privacy-friendly spam protection that requires no external account or API — improving native form security for the basic contact form and extension forms using the CAPTCHA API (SP Page Builder adopted it across all its forms). However, forms still require extensions (RSForm, BreezingForms) for anything beyond basic contact. No CTA management, no conversion tracking, no lead capture integration. Landing page optimization requires external tools. No performance-marketing changes in 6.1.2.

No native personalization engine in Joomla. Access-level-based content visibility (registered/special/public) provides role-based content restriction but this is access control, not behavioral personalization. No geo-targeting, no ML-driven segmentation, no rule-based targeting beyond manual user group assignment. No personalization features in Joomla 6.1.x.

No native A/B testing in Joomla. DM A/B Test extension exists in JED but shows no evidence of active maintenance or Joomla 6 compatibility. VWO can be integrated via JS tag but is fully external. No statistical significance tracking, no auto-winner selection, no experimentation framework in core or via maintained extension. No changes in Joomla 6.1.x.

Once templates are set by a developer, content editors can create and publish articles relatively quickly through the admin UI. Article duplication (save as copy), category-based organization, and scheduled publishing reduce some cycle time. However, new page layouts require developer involvement, there is no true inline frontend editing, and bulk operations are limited. The article editor (TinyMCE 8.0.1 in Joomla 6) is competent but not optimized for marketing velocity workflows. No content velocity improvements in 6.1.x.

Joomla has a JSON:API (REST) for headless content delivery, technically enabling distribution to external channels. However, the content model stores HTML blobs rather than structured channel-agnostic content, limiting utility. No native email publishing, no push-to-social, no SMS or push notification integration. Channel-specific content variants are not supported. Multi-channel delivery requires significant custom development around the API.

No native analytics dashboards within Joomla. Standard tag-based integration with GA4 and similar tools is possible via extensions or manual script injection in templates. No pre-built connectors to GA4, Adobe Analytics, or Mixpanel with content performance metrics surfaced in the CMS. Content decay and engagement data remain fully in external tools. No analytics changes in Joomla 6.1.x.

Joomla templates provide some consistency enforced at the theme level. Joomla 6 introduced Cassiopeia child templates with extended color and font customization via template parameters. However, there are no locked style tokens, no approved component palettes, and no platform-level enforcement preventing off-brand content. Marketers can override styling via HTML modules or article content. No brand guardrail tooling in 6.1.x.

Open Graph and Twitter Card meta tags are not built into Joomla core — they require SEO extensions (4SEO, EFSEO, Advanced SEO). Joomla's native System — Schema.org plugin outputs JSON-LD structured data but is distinct from social preview cards (OG/Twitter), so it does not close the social-sharing gap. Social sharing buttons are available via multiple extensions (JA Social Share, Fast Social Share, AMPZ supporting 50+ networks). No push-to-social scheduling or social workflow capability exists. No changes in 6.1.2.

Joomla's Media Manager provides folder-based file organization with per-asset metadata (title, alt text, description, author, copyright). Basic image cropping and resizing via the Media Action plugin in core. Joomla 6.1 added Media Custom Fields for audio, video, and documents (PR #45013), expanding the content model to natively reference non-image media types in custom fields; Joomla 6.1.2 fixed bugs in these audio/video/document fields so they now save and display correctly. However, still missing: no asset versioning, no usage tracking across content, no rights/expiry management, no focal point cropping, no CDN integration, no WebP auto-conversion.

Joomla has robust built-in multilingual support with separate content per language and language-specific menu items. Joomla 6.1 added multilingual module associations (PR #46671/46772), enabling modules to be linked across language versions the same way articles are associated — improving consistency of localized marketing content including sidebars, banners, and promotional modules across languages. However, no transcreation workflows, no locale-specific campaign variants, no market-level scheduling, and no regional compliance tooling natively.

Some MarTech integrations exist via extensions: Agile CRM, Mailchimp, ActiveCampaign, HubSpot, Constant Contact. However, these are third-party extensions of varying maintenance quality — not pre-built native connectors. No event-based triggers for orchestration. No CDP integration. No ad platform connectors. Marketing automation requires jInbound or external tools. The MarTech ecosystem for Joomla is thinner than most competing platforms. No changes in 6.1.x.

No native PIM or product content modeling. There is no variant/SKU support, no attribute management, no product relationships in core. VirtueMart, HikaShop (v6.4.1 updated May 2026 with Joomla 6 compatibility), J2Commerce, and EShop provide product content through their own models separate from the CMS content layer. The 6.1 media custom fields (audio, video, documents) could enrich product descriptions but don't address the fundamental lack of product content modeling.

No merchandising tools in core Joomla. Commerce extensions provide basic category management and some promotional content support, but sophisticated merchandising (search merchandising, cross-sell/upsell content management, content-driven discovery) is not available. This is not a use case Joomla was designed for. No changes in Joomla 6.1.x.

No pre-built integrations with modern commerce platforms (Shopify, commercetools, BigCommerce). The commerce story remains VirtueMart, HikaShop, or J2Commerce — self-contained e-commerce solutions within Joomla, not integrations with external commerce platforms. Connecting Joomla to headless commerce would require entirely custom development. No changes in 6.1.x.

No native shoppable content or editorial commerce capability. Commerce extensions (VirtueMart, HikaShop) operate in their own content layer separate from Joomla articles. No inline product references within editorial content, no lookbook templates, no buying guide patterns. Creating shoppable content requires custom template development to bridge the CMS and commerce extension layers.

No CMS-managed content in transactional flows. Commerce extension templates (VirtueMart, HikaShop) control cart and checkout pages independently from the Joomla article/module system. There is no mechanism to inject CMS-managed trust badges, upsell banners, or promotional content into checkout without modifying the commerce extension templates directly.

Post-purchase content (order confirmations, delivery tracking, review solicitation) is handled entirely within the commerce extension layer, not the CMS. VirtueMart and HikaShop manage their own transactional email templates. No CMS-managed post-purchase sequences or order-event-triggered content delivery.

Joomla's ACL system can be used to gate catalog sections by user group, providing rudimentary B2B access control. HikaShop has customer group pricing tiers. Sellacious offered multi-vendor B2B capability but shows no evidence of active maintenance or Joomla 6 compatibility. No native contract management, no quote-request flows, no spec sheet management. B2B use is possible via ACL+commerce extension but requires significant customization.

Smart Search (com_finder) provides full-text search with indexed content but no faceted search filtering for product discovery. No blended content-product search results — commerce extensions maintain separate search from the CMS search index (HikaShop ships its own search plugins, updated for Joomla 6 class loading changes). No search merchandising, no synonym management, no search landing pages. The gap between CMS content search and product content search is unbridged.

Joomla supports publish up/down dates for articles and modules, enabling time-activated promotional banners and content scheduling. The core Banners component provides basic ad placement with scheduling. However, there are no countdown timers, no tiered pricing tables, no promo code messaging managed from the CMS, and no channel-specific promotional targeting. Scheduled publishing exists but as a content management feature, not a purpose-built promotions tool.

No native multi-storefront architecture. Serving multiple storefronts would require separate Joomla installations per brand/region with separate commerce extension instances. JMS Multi Sites remains only partially compatible with Joomla 5 and has no confirmed Joomla 6 support. MightySites is positioned as a Joomla 6 multi-site alternative but shares content across instances via shared hosting, not true multi-storefront content management. A core multisite RFC (GitHub discussion #47369) and the in-development SiteHive component signal future direction but nothing stable ships today.

VirtueMart and HikaShop support multiple product images and basic galleries. Video embeds are possible via HTML in product descriptions. Joomla 6.1's media custom fields (audio, video, documents) make it easier to attach video and other media types to content via structured fields rather than HTML embeds — a modest improvement for product media richness, with the fields' save/display bugs fixed in 6.1.2. Still no 360-degree views, no AR/3D model support, no image hotspots, no zoom feature in core Joomla or its major commerce extensions.

HikaShop has multi-vendor capabilities. Quick2Cart and jMarket also offer marketplace-style functionality. However, these are not purpose-built marketplace content platforms — they provide basic seller product submission and category management without sophisticated content quality moderation, seller profile management, or review aggregation systems. Sellacious, which had more B2B/marketplace features, appears to be unmaintained.

Joomla's native multilingual system provides generic localization that can be applied to product content in commerce extensions. Joomla 6.1's multilingual module associations improve cross-language consistency for modules used alongside commerce content. However, currency-aware content blocks and regional regulatory content (EU labels, CA Prop 65) are not natively supported. Commerce extensions handle their own currency display separately from CMS localization.

No connection between CMS content and commerce outcomes. Revenue attribution to content pages, content-assisted conversion tracking, and product content performance measurement are not available natively. GA4 e-commerce tracking can be set up via third-party extensions but requires custom configuration and produces data entirely in Google Analytics — not surfaced within the CMS.

Joomla's ACL provides hierarchical user groups with inheritance, per-article and per-category permissions via the assets table, and configurable viewing access levels that restrict content to specific user groups. Built-in MFA and passwordless login strengthen authentication for intranet use. SSO possible via extensions. The system goes beyond simple RBAC — it is genuinely audience-based content visibility — but no field-level security exists. Joomla 6.1.2 continued hardening the model with additional security fixes (restricted access to media management, privacy features, vCard downloads, and MFA settings), following 6.1.1's MFA-bypass and privilege-escalation CVE patches — hardening without changing capabilities. 6.1.3 (Aug 2026) and 6.1.4 (Sep 29, 2026) fixed a further run of ACL flaws: webservice endpoints, access-level endpoints, workflow stage changes, content history comparison, tagged-item output, batch copy, and another MFA bypass through remember-me cookies. The access model is sound in design, but its enforcement has been patched repeatedly throughout 2026, which is a real concern for intranets that rely on it to gate sensitive content. The score holds at 62.

Categories, tags, and Smart Search provide basic taxonomy and discovery. Joomla's workflow system enables custom content stages and approval transitions for knowledge updates. Joomla 6.1 added a Vue.js-based graphical workflow editor with drag-and-drop stages, keyboard shortcuts, undo/redo, and mini-map navigation, making knowledge lifecycle configuration more accessible. Module versioning (6.1) extends version tracking beyond articles to modules. Extended versioning tracks custom fields, tags, and categories. However, no automated review reminders, no archival workflows beyond manual unpublishing, and no knowledge base templates exist.

Joomla can serve as a basic portal but lacks employee experience features. No notification system for content updates without extensions. No social features (likes, comments require extensions). No employee directory integration in core. No personalized dashboard. JA Intranet template exists as a third-party offering but relies on multiple third-party components (EasySocial, EasyBlog, DocMan). It is a website CMS being repurposed as an intranet, not built for the purpose. No employee experience changes in 6.1.x.

Joomla's ACL-based access levels enable department-specific news publishing by restricting article visibility to relevant user groups, providing basic targeted internal communications. The workflow system supports approval-gated publishing. However, there are no read receipts, no acknowledgment tracking, no mandatory-read workflows, and no audience segmentation beyond manual user group assignment. It is a basic news publishing model, not a purpose-built internal comms platform.

No native employee directory or org chart in Joomla core. The user management system tracks login accounts but not employee profiles, skills, or team hierarchies. miniOrange LDAP/Active Directory integration plugin enables AD-synced user lists but does not provide directory browsing or org chart visualization. EasySocial (third-party, separate product) provides social profiles. Building a functional employee directory requires custom content types or third-party extensions.

Joomla's article versioning and workflow system provide rudimentary content version control and approval stages. Joomla 6.1 extended versioning to modules (PR #46772) and added document-type media custom fields (PR #45013, with save/display bugs fixed in 6.1.2), making it easier to manage document attachments via structured fields rather than file upload links. DocMan (third-party extension) adds document management with folder structure and access control. However, there is no mandatory acknowledgment tracking, no automated review/expiry reminders for policies, and no audit trail specifically for compliance.

No structured onboarding journey features in Joomla. Articles and categories can be organized into an onboarding section with ACL-restricted access, and scheduled publishing could approximate staged content delivery. However, there is no progressive disclosure framework, no task checklists, no HR-system integration for new-hire triggers, and no completion tracking. Building a functional onboarding experience requires extensive custom development.

Smart Search (com_finder) provides indexed full-text search with a map of indexed terms. It supports boosting and filtering by category, author, and date but lacks advanced faceted filtering for intranet knowledge volumes. No federated search across external systems (SharePoint, Confluence, Drive). No AI-powered relevance ranking. Search analytics (failed queries) are not surfaced in the admin panel. Adequate for small sites but not enterprise intranet scale. No search changes in 6.1.x.

No official Joomla mobile app for content access. Joomla sites use responsive templates (Cassiopeia is mobile-responsive by default) providing adequate web-based mobile access. No offline support, no push notifications, no native app distribution, no kiosk/shared-device modes. Frontline workers would access via a mobile browser on a responsive site — functional but not purpose-built for deskless access.

No built-in LMS capability or dedicated learning content management in Joomla. Learning content can be hosted as articles with ACL-restricted access, but there is no course assignment, no completion tracking, no certification management. Third-party LMS extensions exist in JED but are not well-maintained for Joomla 6. Integration with enterprise LMS platforms (Cornerstone, Workday Learning) would require entirely custom development.

No native social or collaboration features in Joomla core — comments, likes, reactions, polls, and community spaces all require third-party extensions. The forum story has improved: Kunena 7.0 stable (current 7.0.6) now runs natively on Joomla 6.0/6.1 without a compatibility plugin, giving Joomla 6 intranets a maintained discussion forum option. EasySocial provides a fuller social layer but is a separate commercial product with its own stack. The capability remains entirely extension-dependent, which caps the score.

Some workplace tool integrations exist via extensions: Microsoft Teams Call extension (OAuth 2.0 via Azure), Slack live chat integration, Microsoft 365 Mail Connect (OAuth 2.0). These are thin integrations — call launching and email connection — not deep embedded content cards, bot-driven notifications, or single-pane employee experiences. No Microsoft 365 document embedding, no Teams channel posting from CMS, no Slack content alerts.

Joomla supports publish up/down dates for automatic content expiry and unpublishing. The graphical workflow editor in Joomla 6.1 (PR #46021) makes it easier to configure content lifecycle stages including review and archive states with a visual drag-and-drop interface. Module versioning in 6.1 extends lifecycle tracking to modules. However, there are no automated review date reminders, no stale content flagging based on age, and no ownership assignment for freshness accountability. Content expiry is possible but requires manual configuration per article — there is no global freshness policy enforcement.

No native internal analytics in Joomla admin. Basic page view tracking available via GA4 integration through extensions, but this provides aggregate site data rather than department-level engagement analysis. No failed search term reporting in admin, no content engagement heatmaps, no intranet adoption dashboards. Analytics for internal content performance require full external analytics setup. No analytics changes in 6.1.x.

No multi-tenant architecture in core. JMS Multi Sites is only partially compatible with Joomla 5 and has no confirmed Joomla 6 support. MightySites provides shared-hosting multi-site management for Joomla 6.x, not true application-level tenant isolation. A core multisite RFC (GitHub discussion #47369, March 2026) and the in-development SiteHive component (single-table site_id architecture for Joomla 6) signal community momentum, but neither has shipped stable — each brand/tenant realistically still requires a separate Joomla installation.

No mechanism for sharing content components across separate Joomla installations. Within a single installation, modules and articles can be shared across pages, but there is no cross-instance sharing, no global templates with brand overrides, no design system support. Multi-brand content reuse requires manual duplication across separate instances.

No cross-brand governance capabilities. Each Joomla instance is independently managed. No central admin across instances, no approval hierarchies spanning brands, no global policy enforcement. Multi-brand governance would require custom tooling or manual processes. The graphical workflow editor in 6.1 improves per-instance workflow management but does not address cross-instance governance.

Zero licensing cost means each additional brand costs only hosting and development — no per-brand licensing increment. Shared hosting can run multiple Joomla instances cheaply. However, there are no shared infrastructure efficiencies within the application — each instance is fully separate. Operational overhead per brand is significant since each requires independent maintenance, updates, and monitoring.

Joomla 6 introduced Cassiopeia child templates with extended color and font customization via template parameters, reducing the need for CSS overrides for basic per-brand theming. 900+ third-party templates are available. Per-brand theming is achievable through template assignment per-instance. However, this is basic CSS/config-level theming — there are no design tokens, no centrally maintained component library with brand extensions, and no version-controlled brand theming across instances.

No brand-locale governance model. Each Joomla instance manages its own multilingual content independently. There is no per-brand translation approval workflow, no shared vs. isolated translation workflow configuration, and no regional legal content governance spanning brands. Multi-brand localization governance requires entirely manual coordination across separate instances.

No cross-brand analytics capability. Each Joomla instance would have its own GA4 property or analytics setup. Portfolio-level content performance reporting requires manual aggregation from multiple analytics accounts. No platform-level reporting across the brand portfolio, no content velocity comparisons, no publishing cadence benchmarking across instances.

Each separate Joomla instance has its own workflow configuration, meaning brands with separate installations can independently configure their publishing workflows using the graphical workflow editor in Joomla 6.1. However, there is no central audit across brands, no cross-brand visibility into publishing activity, and no workflow templates enforced from a central parent configuration. Workflow independence exists only as a byproduct of separate instances.

No content syndication mechanism between Joomla instances. Corporate-to-brand content distribution requires manual copy/paste or custom scripted migration. No syndication feeds between instances, no controlled override points, no push update capability from a parent brand to child brands. Content sharing across the brand portfolio requires entirely custom tooling.

No per-brand/region compliance rule enforcement. Cookie consent is handled via the core Privacy Tool Suite plus extensions. Each instance manages its own compliance settings. No guardrails preventing non-compliant publishing, no centralized data residency controls, no per-brand accessibility enforcement. Generic compliance tooling available per instance but not multi-brand aware.

No federated design system in Joomla. Each instance manages its own template independently. There is no centrally maintained component library with brand-level extensions, no design token versioning, and no update propagation across instances. Maintaining design consistency across multiple Joomla brand instances requires manual template synchronization or a custom build process.

Fully isolated user management per Joomla instance. No central admin console managing users across multiple brand installations. No cross-brand contributor roles, no SSO across Joomla tenants natively (SSO within a single instance is possible via extensions). Each brand team manages its own user accounts and permissions independently.

Fully separate content models per Joomla instance. No shared base content type that brands extend with per-brand fields. Custom fields must be recreated independently per installation. There is no parent content model framework that child brands inherit or extend without forking. Multi-brand content consistency requires manual schema duplication.

No portfolio-level reporting capability. Each Joomla instance is a fully independent CMS with no awareness of sibling brand installations. Content freshness by brand, publishing SLA adherence, cost allocation per tenant, and capacity planning would all require custom-built external tooling aggregating data from multiple independent systems.

Joomla 6.x ships the Privacy Tool Suite in core (com_privacy, verified on the 6.1 branch): consent management, data access/deletion request handling, and a privacy dashboard, and 6.1's built-in ALTCHA PoW CAPTCHA is privacy-first with no external service or data flows. However, no DPA is available to deployers — the Joomla Project is not a data processor, so GDPR obligations fall entirely on the site operator, which caps this in the basic-compliance band. The 6.1.2 security release (2026-07-08) fixing an access-control flaw in com_privacy webservice endpoints shows the suite is actively maintained but does not add new GDPR capability.

No HIPAA BAA is available from the Joomla Project or any affiliated entity, and there are no HIPAA-specific features in Joomla 6 core. Joomla is a volunteer-run OSS project with no healthcare compliance positioning; it is technically deployable on HIPAA-compliant hosting but carries zero platform-level support or documentation.

No FedRAMP, CCPA tooling, LGPD, PIPEDA, or sector-specific compliance features ship in Joomla 6.x. The core GDPR Privacy Suite is the only regulatory feature; broader regional coverage relies entirely on third-party extensions. Score reflects near-absence of regional regulatory tooling beyond basic EU privacy.

As an open-source volunteer project, SOC 2 does not apply — Open Source Matters is not a service organization and holds no SOC 2 attestation. Unlike Drupal or WordPress, Joomla has no enterprise managed-hosting ecosystem providing Joomla-specific SOC 2 coverage; all SOC 2 responsibility falls to the hosting provider chosen by the operator.

ISO 27001 is an organizational certification and Open Source Matters is neither ISO 27001 nor 27018 certified. The Joomla Security Strike Team (JSST) actively manages vulnerability disclosure for the 6.x branch (e.g., the 6.1.2 security release, 2026-07-08) but operates without a formal ISMS certification framework.

No PCI DSS, FedRAMP, CSA STAR, Cyber Essentials, or any other formal compliance certifications exist at the project or software level for Joomla 6.x. Joomla is not positioned for enterprise compliance contexts requiring these certifications, and there is no commercial entity to hold them.

As self-hosted software, Joomla 6 gives operators complete control over data residency — all data-location decisions are determined by the chosen hosting environment. Joomla 6.1's ALTCHA PoW CAPTCHA reinforces this by eliminating the external-service dependency that reCAPTCHA-style solutions introduce, so there are no CDN or SaaS data-flow concerns at the platform level.

Joomla 6.1 core com_privacy handles data-subject Export requests (XML file of the subject's data) and Remove requests (automatic anonymisation) after 24h email-token confirmation, and the core webservice exposes the workflow: requests can be created, listed and exported via /api/index.php/v1/privacy/requests. Core scheduled tasks automate retention: 'Task - Privacy Consents' expires consents after a configurable number of days and 'Delete ActionLogs' purges logs after N days. Capped below the 50s because erasure has no API route (export and create only), there is no site-wide content export in core, and no data classification.

com_actionlogs in 6.1 core records admin and content actions with a selectable event whitelist, optional IP logging and super-user email notification, and supports 'Export Selected/All as CSV'. Retention is configurable through the core 'Delete ActionLogs' scheduled task. It stays below the API-polling band because com_actionlogs has no webservice endpoint (the 6.1 API component list omits it), there is no syslog or SIEM shipping, and no tamper-evident chain; the 2026 run of webservice ACL advisories (6.1.3, 6.1.4) also shows gaps in how access is enforced on the surfaces that would be logged.

Joomla claims WCAG 2.1 and ATAG 2.0 conformance for the backend, and the Sovereign Tech Fund's 20-month accessibility programme (started 2026-07-01) commissioned Axess Lab, an independent external specialist, to audit the Atum admin and baseline conformance (Milestone 1a), with later milestones funding backend template and authoring-form rebuilds. 6.1 also shipped the ALTCHA PoW CAPTCHA (documented WCAG 2.2 AA). The audit results were not yet published as of the 2026-09-02 OSM update, so this stays in the stated-target band rather than documented conformance.

No VPAT, ACR or Section 508 statement exists for Joomla 6, but joomla.org publishes an accessibility statement claiming WCAG 2.1 and ATAG 2.0 backend conformance, and the funded STF programme includes an independent Axess Lab audit with a public commitment to publish results (Milestone 1b covers community publication). That puts Joomla at the floor of the accessibility-page-without-VPAT band; the prior score understated the statement. It would move up once the Axess Lab report is actually public.

Joomla 6.x core ships no native AI text generation: 6.1.3 and 6.1.4 are security/bugfix releases, and the 6.2 feature-frozen list (Beta 1 through RC 1, GA ~2026-10-13) adds preview tokens, a TinyMCE Readmore button and language fallback chains, but no AI. Third-party JED extensions remain the only delivery path (AI Content Assistant by Technodrome with GPT/Gemini/Claude/DeepSeek and tone/length controls, 4AI, JoomAI by miniOrange, AI Content Rewriter). Score stays in the third-party-plugin-only band.

No native AI image generation or AI media processing in Joomla 6.x core — 6.1's media custom fields (audio/video/document) and 6.1.2's fixes to them are structural, not AI. Third-party coverage exists: 4AI supports DALL-E image generation, JoomAI by miniOrange generates images, SP Page Builder Pro includes an AI image generator, and AutoAlt.ai provides AI alt-text for the Media Manager. No native smart focal-point crop or AI DAM processing, holding the score in the 20–35 plugin-only band.

The official GSoC 2026 project pkg_translations (joomla-projects/gsoc26_translator_feedback, v1.0.0 2026-09-11, v1.0.1 2026-09-22) adds LLM machine translation for articles, categories, tags and menu items: a Claude translation plugin behind a provider-agnostic onTranslate event, drafts written as unpublished associated items, a side-by-side human review editor, and a RAG loop that distils translator corrections into terminology/style/preservation rules injected into later prompts. It is a separately installed project extension, not Joomla 6.x core, ships a single provider, and has no quality scoring, so it sits at the top of the no-native-AI band rather than in the 40–60 MT-hookup band.

Plugin-only but growing coverage on Joomla 6: JT AI SEO Assistant explicitly targets Joomla 6 site owners for OpenAI-generated meta descriptions inside the admin workflow; System - AI Meta generates meta descriptions/keywords via Ollama or OpenAI-compatible APIs; JSitemap Pro ships an AI Engines Indexing System with LLMS.txt, Markdown conversion, and AI indexing schema markup; Route 66 and 4SEO add SEO automation. Nothing is built into 6.x core (confirmed absent through 6.1.2 and 6.2 Alpha 2), capping the score at the top of the third-party band.

No native AI content operations in Joomla 6.x core: no auto-tagging, AI routing or duplicate detection, and the 6.1 Visual Workflow Editor is manual stage design, not AI. The official GSoC 2026 pkg_translations extension adds one AI-driven lifecycle automation (scheduled batch translation tasks, and translations sent back to pending when a source item is edited), but it is an optional project package covering translation only. Score stays in the no-AI-workflow band, nudged up for that one assist.

No named agentic product, agent marketplace, or autonomous multi-step workflow capability exists for Joomla 6.x. The official MCP work (PoC, January 2026 sprint) is protocol plumbing that may eventually enable external agents, not a platform agent product, and it is confirmed absent from 6.2. Relevance AI lists Joomla only as an external agent-template target via API. Score reflects no native agentic support.

No built-in AI content intelligence in Joomla 6.x: no content gap analysis, topic clustering, performance scoring, stale content detection, or editorial priority recommendations. Analytics relies entirely on external tools, and the JED ecosystem has not produced a dedicated AI content intelligence product. Neither 6.1.2 nor the 6.2 alphas add such features.

No AI-powered content auditing, brand voice compliance checking, or AI quality scoring in Joomla 6.x core or as established JED products. Existing audit tooling (Route 66, 4SEO accessibility/SEO checks) is rule-based, not AI-driven, and there is no at-scale AI compliance review. Score reflects the no-AI-auditing band.

Joomla 6.x Smart Search remains keyword/boolean-based with no vector search, embedding generation, or RAG-ready indexing in core; the only 6.2 Smart Search work is an access-indexing bugfix. Semantic search requires fully external integration (e.g., Expertrec paid service), and JSitemap Pro's LLMS.txt support aids AI-engine discoverability but is not semantic search. Score stays in the external-integration-required band.

No ML personalization engine exists for Joomla 6.x. Native targeting is limited to user groups and access levels — structural rules only, with no predictive segment assignment, next-best-content recommendations, or personalization analytics. Neither 6.1.2 nor the 6.2 alphas introduce any personalization capability, and no JED extension provides a genuine ML engine.

The official MCP work lives in joomla-projects/joomla-mcp, a joomla-cms fork with a Streamable HTTP endpoint and plugin-registered abilities, but activity stopped on 2026-07-17 with security fixes (token leaks, a debug auth endpoint) still in open PRs, and it is absent from the feature-frozen 6.2 release. The community side broadened: cybersalt/cs-mcp-for-j exposes 51 tools at /api/index.php/v1/mcp using Joomla API tokens, alongside nikosdion/joomla-mcp-php and mcp4j, OnepointConsultingLtd/joomla-mcp-server and nasoma/joomla-mcp-server. None is official GA or widely adopted, so the score stays in the upper announced/beta band.

No shipped core BYOK in Joomla 6.x: the provider-agnostic GSoC 2025 AI Framework (OpenAI/Anthropic/Ollama) is still unmerged and absent from 6.2 RC 1. BYOK is real via extensions: the official GSoC 2026 pkg_translations uses a site-supplied Anthropic key behind a pluggable onTranslate provider contract, and third-party AI Content Assistant (GPT/Gemini/Claude/DeepSeek), JoomAI, 4AI and System - AI Meta (Ollama/OpenAI-compatible endpoints) take user keys. Not higher because no governed core BYOK exists.

Joomla 6.x exposes a REST Web Services API that AI agents can consume, proven by three community MCP implementations built on it, and the official MCP PoC plans a generic plugin wrapping web services to expose CRUD for all entities to AI agents. The unmerged GSoC AI Framework provides provider-agnostic developer interfaces for extension authors. No dedicated AI SDK, official LangChain/LlamaIndex guides, or RAG-ready delivery endpoints ship in core, keeping the score in the standard-API band.

Joomla 6.x core has no AI governance: no AI audit trails, prompt governance, hallucination detection, brand safety or IP indemnification, and the MCP fork's tokens are authentication only. The one governed AI flow is the official GSoC 2026 pkg_translations extension, where machine drafts are saved unpublished for human review and distilled terminology rules stay unpublished until a person approves them, a genuine human-in-the-loop gate but scoped to translation in an optional package. Score stays in the no-governance band, nudged up for that gate.

No AI observability exists in Joomla 6.x core or the extension ecosystem: no token consumption tracking, AI cost/credit dashboards, per-user AI usage metrics, or model performance analytics. AI usage through third-party plugins is completely opaque to site administrators, and neither the MCP PoC nor the AI Framework includes usage metrics. Score reflects the lowest band.