Joomla

Last reviewed Sep 13, 2026 · 817 words

Joomla beats WordPress on exactly two things, and if you need either of them the choice is easy: multilingual sites with no plugin, and a permission system that lets you say "members see this, paying members see that, staff can edit only this section" in core. Everything else, WordPress does with a bigger crowd behind it. Joomla is GPL-2.0, PHP, 5,133 stars, and around since 2005; it is not dying, but its community is a fraction of WordPress's and you will feel that the first time you search for an extension at 11 pm.

Multilingual in core is a real advantage, not a bullet point

Every WordPress multilingual site runs on a plugin (WPML, Polylang, TranslatePress), each with its own database layout and its own way of breaking after an update. Joomla ships language associations in core: you install a language pack, enable the language filter and switcher plugins, and every article, menu item, and module carries a language and can be linked to its translation. A 3-language site in Joomla is a configuration task; in WordPress it is an ongoing plugin relationship. For a European small business, a tourism site, or a bilingual organisation, this alone justifies the choice.

Access levels are the second reason people stay

Joomla's ACL has user groups (nested, inheritable), access levels (a view permission attached to content), and per-component, per-category permissions for actions like create, edit, edit own, publish, and delete. A club site where committee members edit the news section, the treasurer alone edits the finance pages, and members-only pages sit behind a login is core Joomla with no extension. WordPress gets there with a membership plugin and a role editor, and the result is more fragile. The catalogue's "flexible access control levels" highlight is the feature I would name if someone asked me why Joomla still exists.

The Docker setup mirrors WordPress's

The official joomla image serves on port 80 and wants MySQL or MariaDB; PostgreSQL is supported too.

services:
  joomla:
    image: joomla:5-apache
    ports:
      - "8080:80"
    environment:
      JOOMLA_DB_HOST: db
      JOOMLA_DB_USER: joomla
      JOOMLA_DB_PASSWORD: change-this
      JOOMLA_DB_NAME: joomla
    volumes:
      - ./joomla:/var/www/html
  db:
    image: mariadb:11
    environment:
      MARIADB_DATABASE: joomla
      MARIADB_USER: joomla
      MARIADB_PASSWORD: change-this
      MARIADB_ROOT_PASSWORD: change-this-too
    volumes:
      - ./db:/var/lib/mysql

The web installer finishes the job; the admin panel is at /administrator. The catalogue's 512 MB minimum is realistic for PHP-FPM plus MariaDB on a small site. Back up the database and the whole /var/www/html tree, because extensions, templates, and configuration.php all live there. Joomla's built-in updater handles minor releases from the admin panel; major upgrades (the 4-to-5 move, for instance) are supported in-place but require checking every third-party extension for compatibility first, and that is where sites get stuck for years.

Security posture, honestly

Joomla has had serious vulnerabilities in its history, as has every PHP CMS of its age, and the mitigation is the same: apply updates within days, not months. Two-factor authentication and passkeys (WebAuthn) are in core, so turn them on for every admin account. Rename nothing, hide nothing, and instead put the /administrator path behind your reverse proxy's basic auth or an identity provider like Authentik if the site is public. Extension quality is the real risk: the Joomla Extensions Directory lists thousands, many abandoned, and an unmaintained component is how a Joomla site actually gets compromised. Prefer extensions updated in the last year with a paid tier, because a paid tier means someone is still there.

Where WordPress is the safer pick anyway

Blogging, e-commerce, and anything a non-technical owner will maintain alone. WordPress's block editor is friendlier than Joomla's article editor, WooCommerce has no Joomla equivalent of the same maturity, and the supply of themes, agencies, and tutorials is 10 to 20 times larger. If the site is a blog or a shop, go to WordPress and do not look back. If it is a complex portal with structured content types and a developer on staff, Drupal sits above Joomla in power and in effort. Joomla's middle position is genuine, and the CMS category has a reasonable number of people for whom the middle is exactly right.

What I'd do

For a multilingual site or a membership site with tiered access, I would run Joomla 5 on the official image with MariaDB, 2FA on every admin, no more than 6 or 7 well-maintained extensions, and updates applied the week they ship. For anything else I would choose WordPress, not because Joomla is worse, but because when something breaks at 11 pm the answer is easier to find. Existing Joomla sites should stay on Joomla and keep upgrading; the migration to WordPress costs more than the maintenance it saves.