User Documentation Joomla's user system covers who can access your site and what they're allowed to do once they're in, plus a wide range of tools for keeping accounts secure. This section covers setting up accounts, groups, and access levels, and the password, authentication, and login security features Joomla provides.
User Accounts and Access
The building blocks of who can use your site and what they can do: registering and managing accounts, controlling access by group and access level, and keeping a record of what users do.
- Access Control – Joomla's Access Control List (ACL) system: user groups, access levels, and permissions at the global, component, and individual-item level.
- User Registration – Allowing or disabling self-registration, choosing how new accounts are activated, and adding, blocking, or unblocking users manually.
- User Profile – Letting logged-in users manage their own details through additional profile fields and an Edit Profile menu item.
- Guest Access – Using the Guest and Registered access levels to show or hide content, such as login and logout menus, based on whether a visitor is signed in.
- Changing User's Groups – The user group hierarchy from Guest to Super User, and how to move a user between groups.
- User Actions Log – The audit log Super Users can use to track website activity, including how to configure it and hook custom extensions into it.
Login Security
Passwords, modern authentication methods, and login/logout behaviour, for keeping accounts secure and getting users to the right place when they sign in.
- User Password Reset – Letting users reset their own password by email, or resetting one directly from the backend as an administrator.
- Admin Password Recovery – Recovering a locked-out administrator account by temporarily editing configuration.php or changing the password directly in the database.
- User Password Security – Setting password strength requirements, including character types and OWASP-recommended special characters.
- WebAuthn Login – Passwordless sign-in using biometric devices or security keys, including registering authenticators and browser/server requirements.
- Multi-factor Authentication – Adding an optional second verification step after password login, with methods including TOTP, YubiKey, WebAuthn, and email codes.
- Login and Logout Redirects – Sending users to specific pages after signing in or out, using login modules and login/logout menu items.