Joomla Global Configuration — Site, System, Server and Permissions Tabs

In this tutorial, you'll learn about Joomla Global Configuration — every tab and setting across Site, System, Server, and Permissions, and how each setting affects your site's behavior, security, and performance.

What You'll Learn

• How to access Global Configuration (System > Global Configuration)
• The Site tab: site name, offline mode, meta data, SEO settings, cookie/PDF/email icons
• The System tab: secret word, log/temp paths, error reporting, debug, cache settings
• The Server tab: timezone, mail settings, database info, FTP settings
• The Permissions tab: user group permissions, text filters
• How each setting affects security, performance, and functionality
• Best practices for configuring each tab

Why It Matters

Global Configuration is the control center of your Joomla site. Every setting here affects how your site behaves, how secure it is, how it performs, and how users interact with it. Misconfiguring Global Configuration can break your site, expose sensitive information, or slow down performance. Understanding every option helps you make informed decisions.

Real-World Use

A Joomla site is migrated from development to production. The developer updates the Site Name, enables SEF URLs, turns off error reporting, sets up SMTP email, configures caching with Redis, adjusts the session lifetime, and sets the correct timezone. These Global Configuration changes prepare the site for public launch.

Learning Path

flowchart LR
  A["User Management"] --> B["Global Configuration
You are here"]:::current
  B --> C["Security Hardening"]

  classDef current fill:#38bdf8,color:#0f172a,stroke-width:2px

Accessing Global Configuration

You can access Global Configuration in two ways:

1. System > Global Configuration in the admin menu
2. Click the gear icon in the toolbar on many admin pages

The interface has four tabs: Site, System, Server, Permissions.

Site Tab

The Site tab controls how your site appears and behaves for visitors.

Site Settings

Metadata Settings

# Site > Metadata Settings
# Default Meta Description: "Learn Joomla with step-by-step tutorials"
# Default Meta Keywords: (leave empty — Google ignores meta keywords)
# Robots: "Index, Follow" — allows search engines to index the site
# Rights: "Creative Commons Attribution 4.0" or leave blank

SEO Settings

# SEO Settings — critical for search rankings
# Search Engine Friendly URLs: Yes
# Use URL Rewriting: Yes (requires htaccess.txt renamed to .htaccess)
# Adds Suffix to URLs: No
# Unicode Aliases: Yes

Cookie and Display Settings

System Tab

The System tab controls system-wide behavior, caching, debugging, and session settings.

System Settings

# System > System Settings
# Secret Word: Auto-generated random string (do not change unless needed)
# Path to Log Folder: /var/www/html/logs or /home/username/logs
# Path to Temp Folder: /var/www/html/tmp or /home/username/tmp
# Help Server: English (default)

The Secret Word is used for encryption and security operations. Joomla generates this during installation. Do not change it unless you understand the consequences.

Debug Settings

# Debug Settings — only enable during development
# Debug Site: No
# Debug System: No
# Debug Language: No

Enabling debug on production is a security risk. It reveals file paths, database queries, and configuration values.

Cache Settings

# Cache Settings for production
# Cache: On - Conservative
# Cache Handler: File (or Redis if available)
# Cache Time: 15
# Platform Specific Caching: No

Cache handlers:

Session Settings

# System > Session Settings
# Session Lifetime: 60 (minutes)
# Session Handler: Database (default) or File

Set Session Lifetime appropriately:

• 15-30 minutes for high-security sites
• 60-120 minutes for general sites
• Higher values for sites where users need long sessions

Error Reporting

# Error Reporting options
# System Default — uses PHP's error_reporting setting
# None — suppresses all errors
# Simple — shows basic errors
# Maximum — shows all errors (development only)

For production sites, set Error Reporting to "System Default" or "None". "Maximum" reveals file paths and system information to visitors.

Server Tab

The Server tab controls server-related settings including timezone, mail, and database.

Server Timezone

# Server > Server Settings
# Server Timezone: UTC or your local timezone

Set this to the timezone where your content is published. Joomla uses this timezone for article publishing dates and other time-based features.

Mail Settings

# Mail Settings for SMTP (most reliable)
# Mailer: SMTP
# From Email: noreply@yoursite.com
# From Name: Your Website
# SMTP Host: smtp.yourhost.com
# SMTP Port: 465 (SSL) or 587 (TLS)
# SMTP Security: SSL or TLS
# SMTP Authentication: Yes
# SMTP Username: your-email@yoursite.com
# SMTP Password: your-email-password

SMTP vs PHP Mail

Always use SMTP for production sites. PHP Mail is often blocked by hosting providers and emails may not be delivered.

Database Information

# Server > Database (read-only information)
# Database Type: MySQLi or PDO MySQL
# Host: localhost or database server address
# User: database username
# Database Name: joomla_database
# Database Prefix: jos_ (configurable during installation)
# Database Encryption: None (default)

This section is read-only. It shows the current database connection information.

FTP Settings

FTP settings are deprecated in Joomla 4+. They were used in older versions to help with file permissions. Leave these at default values.

Permissions Tab

The Permissions tab shows a tree of user groups. Click a group to expand and see its permissions.

Understanding the Permissions Table

Each user group has permissions for all installed components, plus global actions:

Configuring Global Permissions

# Example: Set Registered users to have frontend login only
# System > Global Configuration > Permissions
# Click "Registered" group
# Site Login: Allowed
# Admin Login: Denied
# All other actions: Inherited
# Save

Text Filters

Text filters control what HTML tags are allowed in content for each user group.

# Example: Text Filters for security
# Super Users: No Filtering
# Managers: Filtered HTML
# Registered: Filtered HTML
# Public: No Filtering (public cannot write content)

Restricting HTML filtering for lower-level users prevents XSS attacks through content.

Best Practices by Tab

Site Tab Best Practices

• Set a descriptive site name for search engine result pages
• Enable SEF URLs and URL rewriting
• Disable PDF, Print, and Email icons to reduce page clutter
• Set Meta Description to a compelling site summary

System Tab Best Practices

• Enable caching on production (Conservative mode)
• Set Debug to No on production
• Set Error Reporting to System Default
• Never change the Secret Word without backing up first
• Set Session Lifetime between 30-120 minutes

Server Tab Best Practices

• Use SMTP for email delivery
• Set the correct timezone
• Log file paths should not be web-accessible
• Keep database credentials secure (do not share)

Permissions Tab Best Practices

• Only change permissions you need to change
• Follow the "least privilege" principle
• Use text filters to prevent XSS attacks
• Test permission changes with real user accounts

Common Mistakes

1. Enabling Debug on production: You turn on Debug to troubleshoot a problem and forget to turn it off. Visitors see database queries, file paths, and system information. This is a serious security risk.

2. Using PHP Mail instead of SMTP: You leave the mailer set to PHP Mail. Important emails (password resets, user activation) go to spam or are never delivered. Always use SMTP for reliable email delivery.

3. Disabling caching without reason: You turn off caching because you heard it causes issues. Your site loads slowly for every Visitor. Enable Conservative caching for most sites.

4. Not setting text filters for user groups: You allow all users to submit content with No Filtering. A user submits an article with malicious JavaScript that executes on every page view. Always set text filters to Filtered HTML for untrusted groups.

5. Forgetting SEF URL settings during Migration: You migrate the site and forget to enable SEF URLs and URL rewriting. All URLs show as index.php?option=com_content&view=article&id=1. This hurts SEO and user experience.

Practice Questions

1. What is the difference between "Cache — On — Conservative" and "Cache — On — Progressive"? Answer: Conservative caching only caches pages that are explicitly cached by extensions. Progressive caching caches all pages by default, including dynamic content. Conservative is safer for most sites; Progressive can cause issues with dynamic features like shopping carts.

2. Why should you use SMTP instead of PHP Mail for Joomla's email settings? Answer: PHP Mail is unreliable — emails often go to spam folders or are not delivered at all. SMTP uses authenticated connections to a mail server, which dramatically improves deliverability. SMTP also supports encryption (SSL/TLS) for security.

3. What does "Use URL Rewriting" do and what does it require? Answer: "Use URL Rewriting" removes index.php from URLs, turning example.com/index.php/about-us into example.com/about-us. It requires Apache mod_rewrite (or equivalent) and the htaccess.txt file must be renamed to .htaccess.

4. Challenge: Configure Global Configuration for a production Joomla site. Start from a fresh installation. Set the Site Name, enable SEF URLs with URL rewriting, disable PDF and Print icons, enable Conservative caching with 30-minute cache time, set error reporting to None, configure SMTP email with your email service credentials, set the correct timezone, configure Registered users to have Site Login only, and set text filters to Filtered HTML for Authors and Editors. Test that all settings work correctly.

FAQ

Mini Project

Your task: Configure Global Configuration for a real-world e-commerce site.

1. Set the Site Name to your fictional business name.
2. Enable SEF URLs, URL rewriting, and Unicode aliases.
3. Set Default Meta Description to a compelling 155-character description.
4. Turn off Author display, PDF, Print, and Email icons.
5. Enable Conservative caching with 30-minute cache time.
6. Set Error Reporting to None.
7. Configure SMTP email using Gmail SMTP (smtp.gmail.com, port 587, TLS).
8. Set Server Timezone to your local timezone.
9. Create a custom user group "Customers" with parent "Registered" that has Site Login allowed and Admin Login denied.
10. Set text filters so "Customers" and "Registered" groups use Filtered HTML.
11. Verify that SEF URLs work correctly on the frontend.
12. Send a test email to confirm SMTP works.

This project covers the most important configuration tasks for any production Joomla site.

What's Next

Now that you understand all of Global Configuration, you are ready to secure your site:

Continue to Lesson 28: Security Hardening — Learn how to harden your Joomla site with .htaccess, 2FA, updates, and file permissions.

Related lessons:

• Joomla User ACL — Configure permissions for each user group
• Joomla Essential Extensions — Install Admin Tools for additional security