Joomla CMS Installation and Setup

Joomla CMS Installation and Setup

Joomla 5.x is installed via web installer or Composer. For production — Composer is preferable: dependency management, updates via CLI.

Installation via Composer

# Create Joomla 5 project
composer create-project joomla/website-template my-joomla-site
cd my-joomla-site

# Or download directly
wget https://downloads.joomla.org/cms/joomla5/5-x-x/Joomla_5.x.x-Stable-Full_Package.tar.gz
tar xzf Joomla_5*.tar.gz

Nginx Configuration

server {
    listen 443 ssl http2;
    server_name yourdomain.com;
    root /var/www/yourdomain.com;
    index index.php;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    # Joomla security
    location ~ /\.htaccess { deny all; }
    location ~ /configuration\.php { deny all; }
    location ~* /(logs|tmp)/.*\.php$ { deny all; }
    location ~* /administrator/.*\.(php)$ {
        try_files $uri =404;
        fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
}

Web Installer: Steps

1. Language selection
2. System requirements check (PHP 8.1+, extensions)
3. Database data: host, name, user, password, table prefix
4. Configuration: site name, email, admin password
5. Installation → delete installation/ folder (Joomla requires this)

Security After Installation

// configuration.php (don't edit manually, use admin panel)
// But verify these values:
public $secret = 'unique-random-string';  // generated automatically
public $force_ssl = '2';     // 2 = force HTTPS everywhere
public $live_site = 'https://yourdomain.com';
public $tmp_path = '/var/www/yourdomain.com/tmp';
public $log_path = '/var/www/yourdomain.com/logs';

Move tmp and logs folders above web-root for additional security.

Global Configuration (Key Parameters)

Server:

• PHP Error Reporting: None (production)
• Gzip Page Compression: Yes
• Cache: Conservative caching

SEO:

• Friendly URLs: Yes
• Use URL rewriting: Yes (need mod_rewrite or Nginx)
• Add Suffix to URLs: No (no .html)
• Unicode Aliases: Yes (for non-ASCII URLs)

Media:

• Maximum size: per server capabilities
• Allowed extensions: remove exe, php, phtml

Two-Factor Authentication

Joomla 5 includes 2FA out of the box: System → Two-Factor Authentication → enable TOTP or YubiKey plugins. Configured in user profile.

Timeline

Joomla installation on VPS with Nginx, SSL, basic security configuration — 3–5 hours.