Joomla Plugins — Authentication, Content, Editors and System Plugins

In this tutorial, you'll learn about Joomla plugins — event-driven extensions that handle authentication, content transformation, editing, system tasks, and search — and how to enable, configure, and order them effectively.

What You'll Learn

• What plugins are and how they work as event handlers
• How to access and filter the Plugin Manager (Extensions > Plugins)
• Plugin types: Authentication, Content, Editors, Editors-xtd, System, Search, User, Behavior
• How to configure individual plugin parameters
• Why plugin ordering matters for System and Content plugins
• Plugin events and when they fire
• How to handle Joomla update notifications
• Best practices for managing plugins

Why It Matters

Plugins are the invisible workers of Joomla. They handle authentication when users log in, transform content when articles are displayed, route URLs, manage caching, and run system maintenance tasks. Understanding plugins helps you debug issues, optimize performance, and extend functionality without installing separate extensions.

Real-World Use

A Joomla site needs to show a "Related Articles" section at the bottom of each article. The site administrator enables the Content — Load Module plugin. They create a Custom HTML module with the related articles content and insert {loadposition related-articles} in the article text. The plugin detects the shortcode, loads the module, and renders the related articles below the main content.

Learning Path

flowchart LR
  A["Core Components"] --> B["Plugins
You are here"]:::current
  B --> C["Languages"]
  C --> D["Essential Extensions"]

  classDef current fill:#38bdf8,color:#0f172a,stroke-width:2px

What Are Plugins?

Plugins are event handlers. They register to listen for specific events in Joomla's lifecycle. When that event fires, all registered plugins execute in order.

Think of plugins as small programs that sit between Joomla's core code and the output. When a user loads an article, Joomla fires events like onContentBeforeDisplay and onContentAfterDisplay. Content plugins that listen to these events can modify the article content before it reaches the browser.

flowchart LR
  A["Event Triggered"] --> B{"Plugin enabled
and published?"}
  B -->|Yes| C["Plugin executes"]
  B -->|No| D["Skipped"]
  C --> E["Output modified or action taken"]
  D --> F["Default behavior"]

Plugin Manager

Access the Plugin Manager from Extensions > Plugins. This page shows all installed plugins. Key features:

• Search: Find plugins by name
• Filter: Filter by type (authentication, content, system, etc.)
• Sort: Sort by name, type, order, or status
• Status: Green check = enabled, grey circle = disabled
• Order: Drag to reorder (order matters for some types)

# Accessing the Plugin Manager
# Extensions > Plugins
# Use the filter dropdown to show specific types
# Click plugin name to edit
# Toggle status with the green check / grey circle

Plugin Types

Authentication Plugins

Authentication plugins handle user login validation. They check credentials against a data source.

Authentication plugins run in order. If the first plugin succeeds, the user is logged in. If it fails, the next plugin tries. Multiple authentication plugins let you support different login methods.

# Authentication plugin flow
# 1. User submits login form
# 2. First auth plugin tries to validate
# 3. If successful, user is logged in
# 4. If not, next auth plugin tries
# 5. If all fail, login error is shown

Content Plugins

Content plugins modify article content during display. They run when an article is loaded.

The Content — Load Module plugin is particularly useful. It lets you insert modules inside article content:

<!-- In your article text, add this shortcode -->
{loadposition my-position}

<!-- Or load a specific module by ID -->
{loadmodule mod_articles_latest}

This requires the Content — Load Module plugin to be enabled.

Editors Plugins

Editors plugins provide the text editing interfaces used in the backend and frontend.

Users can choose their preferred editor in their user profile.

Editors-xtd Plugins

Editors-xtd (extended) plugins add buttons to the editor toolbar.

These buttons appear in the editor toolbar when editing content. If you do not see a button, the corresponding Editors-xtd plugin may be disabled.

System Plugins

System plugins run during page initialization and core operations.

The System — Debug plugin is invaluable during development. When enabled, it shows:

• Database query log
• Memory usage
• Execution time
• Language translation status
• Profile information

Enable it only on staging sites — it reveals sensitive information on production sites.

Search Plugins

Search plugins provide content to Smart Search indexing.

Each search plugin must be enabled for its content type to appear in Smart Search results.

User Plugins

User plugins handle user-related events.

Behavior Plugins

Behavior plugins add JavaScript behaviors and polyfills.

Plugin Configuration

Each plugin has its own configuration parameters. To edit a plugin:

1. Go to Extensions > Plugins
2. Find the plugin (search or filter by type)
3. Click the plugin name
4. Configure the parameters
5. Save

Common plugin parameters include:

<!-- Example: Content — Email Cloak plugin parameters -->
<field name="mode" type="list" default="link">
  <option value="link">Link with mailto</option>
  <option value="text">Text with encoded address</option>
</field>

<field name="cloak_email_addresses" type="radio" default="1">
  <option value="1">Yes</option>
  <option value="0">No</option>
</field>

Each plugin's edit page also shows:

• Status: Published (enabled) or Unpublished (disabled)
• Access: Access level for the plugin's functionality
• Order: Execution order within the plugin type group
• Note: Optional note for identification

Plugin Ordering

Plugin ordering matters. System and Content plugins execute in order. If one plugin modifies content and another plugin expects the original content, the order matters.

# View and change plugin order
# Extensions > Plugins
# Click the "Ordering" column header
# Drag and drop plugins to reorder
# Or edit each plugin and set its order number

Example where order matters:

1. Content — Email Cloak (order 1): Converts email addresses to protected text
2. Content — Load Module (order 2): Processes {loadposition} shortcodes
3. Content — Page Navigation (order 3): Adds prev/next links

If Load Module ran before Email Cloak, an email address inside a module's content might not be cloaked.

Plugin Events

Plugins listen for specific events. Understanding these events helps you know when a plugin runs.

Default Plugin Checklist

When you install Joomla, some plugins are enabled by default and others are disabled. Here is a checklist of plugins you should verify:

Must Be Enabled

• Authentication — Joomla
• Content — Email Cloak
• Editor — TinyMCE
• System — Language Filter (if using multilingual)
• System — SEF (for SEO-friendly URLs)
• System — Remember
• System — Logout
• User — Joomla

Should Be Disabled (unless needed)

• System — Debug (only on staging sites)
• System — Stats (optional)
• Authentication — GMail (rarely used)
• Authentication — LDAP (only if using directory authentication)

Enable Based on Needs

• Content — Load Module (needed for {loadposition} shortcode)
• Content — Page Break (needed for multi-page articles)
• Content — Vote (needed for article ratings)
• System — Cache (needed for caching)
• System — Redirect (needed for URL redirect management)

Joomla Update Notification Plugin

The "System — Joomla Update Notification" plugin sends email notifications when Joomla updates are available. Enable and configure it to receive alerts:

# Configure update notifications
# Extensions > Plugins > System - Joomla Update Notification
# Set "Email Addresses" for recipients
# Choose notification frequency
# Enable "Send on new minor versions" or "Send on all updates"

Common Mistakes

1. Disabling essential plugins: Beginners disable system plugins like "System — SEF" to troubleshoot an issue, then wonder why URLs break. Research what a plugin does before disabling it.

2. Enabling Debug on production: The "System — Debug" plugin shows database queries, passwords, and system paths. This is a security risk on live sites. Only enable debug on local or staging environments.

3. Ignoring plugin order: Content plugins transform articles in order. If your {loadposition} shortcodes are not working, check that Content — Load Module runs before the content is fully rendered.

4. Overlooking Editors-xtd plugins: You install TinyMCE but the "Insert Image" button is missing. The "Button — Image" Editors-xtd plugin is probably disabled. Editors-xtd plugins control toolbar buttons.

5. Not checking search plugins when Smart Search returns no results: Smart Search returns nothing because the "Smart Search — Content" plugin is disabled. Each content type needs its corresponding search plugin enabled.

Practice Questions

1. What is the difference between an Editors plugin and an Editors-xtd plugin? Answer: Editors plugins provide the actual editor interface (TinyMCE, Code Mirror). Editors-xtd plugins add buttons to the editor toolbar (Insert Image, Insert Article Link, Page Break). You need at least one Editors plugin and optional Editors-xtd plugins for toolbar buttons.

2. Why might the {loadposition} shortcode not work inside an article? Answer: The Content — Load Module plugin must be published. If it is disabled, Joomla does not Process the {loadposition} or {loadmodule} shortcodes. Also check that the module exists and is assigned to the named position.

3. What security risk does the System — Debug plugin pose on a production site? Answer: The Debug plugin displays database queries (which may contain user data), system paths, configuration values, and memory usage. This information helps attackers understand your server setup and find vulnerabilities. Never enable Debug on production sites.

4. Challenge: Audit all plugins on a Joomla installation. List every plugin, its type, its status (enabled/disabled), and whether it should be enabled based on the site's needs. Disable unnecessary plugins. Enable Content — Load Module. Configure System — Joomla Update Notification to send alerts to your email. Verify that plugin order for Content plugins puts Email Cloak before Load Module.

FAQ

Mini Project

Your task: Configure a complete plugin setup for a content-driven Joomla site.

1. Audit the Plugin Manager. List all currently disabled plugins. For each one, decide whether to enable or leave disabled and document your reasoning.
2. Enable Content — Load Module. Create a module and display it inside an article using {loadposition}.
3. Configure Content — Email Cloak. Set it to use link mode. Add an email address in an article and verify it is cloaked on the frontend.
4. Enable System — Redirect. Create a redirect from an old URL to a new one. Test that the redirect works.
5. Configure System — Joomla Update Notification to send emails to your address.
6. Create a custom Editors-xtd setup by enabling only specific buttons (Image, Page Break) and disabling others.
7. Reorder Content plugins so Email Cloak runs before Page Break.
8. Test every change on the frontend.

This exercise builds practical skills in plugin management — a critical part of maintaining any Joomla site.

What's Next

Now that you understand plugins, you are ready to make your site multilingual:

Continue to Lesson 23: Languages — Learn how to install languages, create content language associations, and build multilingual sites.

Related lessons:

• Joomla Core Components — Understand how content is structured
• Joomla Extension Manager — Install new plugin extensions