Installing and configuring Joomla 5
Imagine: you have a VPS with Ubuntu and Nginx, and you need to deploy Joomla 5 from scratch. The web installer seems simple, but in production it often leads to permission issues and difficulties with updates.
Over many years of working with Joomla, we have developed an approach that guarantees stability and security. Incorrect configuration can lead to data leaks or site crashes under load.
Therefore, every stage — from choosing the environment to final checks — must be performed according to strict rules.
What problems do we solve?
PHP incompatibility. Joomla 5 requires PHP 8.1+, while many servers are still on 7.4. We check the environment, install the required version and all extensions (json, pdo_mysql, gd, mbstring, xml).
Permission errors. After the web installer, files often belong to the www-data user instead of your SSH user. This breaks updates via Composer. We use the correct ownership scheme.
Weak security out of the box. By default, Joomla does not enforce HTTPS, does not enable two-factor authentication, and the installation/ folder remains accessible. We close all these vulnerabilities at the start.
Why choose installation via Composer?
Composer is far more reliable than the web installer for production. It allows you to manage dependencies, update easily, and set permissions correctly. The web installer leaves www-data as the owner of files, which blocks composer update.
Composer, on the other hand, uses the SSH user, and all subsequent operations are possible without issues.
How do we do it?
Our typical case is installing Joomla 5.1 on a VPS running Ubuntu, Nginx, PHP 8.3, MySQL 8.
- Creating the database and user. We use MariaDB or MySQL. We assign all privileges to the required DB.
- Installation via Composer.
composer create-project joomla/website-template /var/www/yoursite cd /var/www/yoursite composer install --no-dev
- Configuring Nginx. We bring the configuration to production standard:
server {
listen 443 ssl http2;
server_name yoursite.com;
root /var/www/yoursite;
index index.php;
location / { try_files $uri $uri/ /index.php?$args; } location ~ \.php$ { fastcgi_pass unix:/var/run/php/php8.3-fpm.sock; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; }
location ~ /\.htaccess { deny all; } location ~ /configuration\.php { deny all; } location ~* /(logs|tmp)/.*\.php$ { deny all; }
location ~* /administrator/.*\.(php)$ {
try_files $uri =404;
fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
}
- Running the web installer. Through the browser, we go through the steps: language selection, requirements check, DB connection, site setup.
- Removing the installation/ folder and setting the correct file permissions.
What is included in the work?
- Full installation and configuration of Joomla 5 on your server
- Nginx + SSL configuration (Let's Encrypt)
- Security setup: removing installation/, enforcing HTTPS, moving logs, 2FA
- Enabling SEF URLs and UTF-8 alias
- Optimization for Core Web Vitals: caching, gzip, headers
- Performance testing (Google PageSpeed Insights)
- Handing over access credentials and brief documentation
Comparison of installation methods
| Criterion | Composer | Web installer |
|---|---|---|
| Dependency management | Yes, via composer.json | No |
| Updates | Via CLI, simple | Manual file replacement required |
| Permissions | Easy to configure | Often problematic |
| For production | Yes | Only for dev |
Additional table: PHP requirements for Joomla 5
| Extension | Purpose |
|---|---|
| json | JSON processing |
| pdo_mysql | MySQL access |
| gd | Image processing |
| mbstring | Multibyte strings |
| xml | XML parsing |
How to configure Joomla security?
After installation, perform a minimal set of actions. Remove the installation/ folder — otherwise an attacker could reinstall the site. Enable forced HTTPS via force_ssl = 2 in configuration.php.
Move the logs and tmp folders outside the web-root so they cannot be read from the browser. Configure two-factor authentication for administrators. Make sure the secret key secret is a random string of at least 32 characters.
Checklist of common mistakes
- The installation/ folder is left in place — Joomla requires it to be removed, otherwise the site is vulnerable.
- Incorrect table prefix — may conflict with other CMS.
- Weak secret key — in the configuration, secret must be a random string of at least 32 characters.
- PHP error display enabled — in production, error_reporting = off is mandatory.
Timelines and guarantees
Installing Joomla on a VPS with basic configuration takes 3 to 5 hours. If additional customization is required (templates, components) — up to 2 business days. We provide a work guarantee: 30 days of support after project completion.
Our engineers hold Joomla certificates and have many years of experience. During this time, we have successfully launched more than 120 projects on this CMS. If you want a production-ready Joomla installation, contact us — we will complete the work efficiently and on time. Get in touch with us for a consultation — we will assess your project.
