Skip to main content
J!UM Security

Security and Control
for Centralized Joomla Administration

J!UM accesses administrative functions across multiple Joomla websites. Security is therefore not an optional add-on, but an integral part of the architecture – from protected connections and secure storage of sensitive credentials to the controlled execution of persistent background jobs.

J!UM focuses on the centralized management of components, modules, plugins and templates. Joomla Core updates intentionally remain Joomla's responsibility.

Protected Connections
Encrypted Credentials
Controlled Actions
Reliable Background Jobs
Responsible Boundaries
J!UM Connector

Protected Connections

Communication between the J!UM Control Center and managed Joomla websites takes place through secured connector endpoints.

J!UM accepts connector connections exclusively over HTTPS. Each managed website authenticates requests using its own sufficiently long connector token.

If the Joomla administrator area is additionally protected by HTTP Basic Authentication, the required credentials can be stored separately from the connector token.

This keeps access credentials for individual projects separated and independently manageable.

Protection of Sensitive Credentials

Encrypted Credentials

Connector tokens, HTTP passwords and Akeeba secrets are not stored as plain text in the project overview.

J!UM encrypts sensitive credentials using the individual Joomla secret of the Control Center installation. Values are decrypted only when they are required for the respective authorized operation.

Sensitive credentials are not unnecessarily exposed in logs or visible status information and are not stored as plain text in persistent job data.

Security Tokens

Controlled Actions

Write operations in J!UM require administrative permissions and valid Joomla security tokens.

Inputs are checked against the expected data types, formats and value ranges. External responses from connected Joomla websites are sanitized before display and rendered according to context.

Output is escaped appropriately for the relevant HTML context. This helps J!UM reduce common attack surfaces such as manipulated input, cross-site scripting and unauthorized action requests.

Log values are additionally limited and reduced to useful information so that malicious or faulty external content is not passed unchecked into the administration interface.

Heartbeat & Queue

Reliable Background Jobs

Long-running maintenance tasks are processed in J!UM as persistent jobs.

Atomic locks prevent the same job step from being executed multiple times at the same time. Heartbeats and timestamps show the state of running processes and help identify interrupted or orphaned operations in a controlled way.

Limited retry attempts prevent endless loops in the event of temporary errors. The next processing step starts only after the previous request has finished, preventing parallel execution of the same workflow.

The job view remains transparent throughout: progress, individual steps, last activity and results can be tracked. For Akeeba backups, J!UM also displays the progress reported by Akeeba and the currently active processing step.

Responsible Boundaries

J!UM supports a secure and traceable Joomla maintenance process, but it does not replace a complete backup and recovery strategy, server hardening or an incident response solution.

Joomla Core updates are also intentionally not performed by J!UM. Joomla provides its own update mechanisms and automatic Core update functionality for this purpose.

J!UM focuses on the centralized management of components, modules, plugins and templates, as well as complementary maintenance, backup, monitoring and security information.

Automatic rollback to an older Joomla or extension version is not part of the current version.

Joomla handles its own Core updates – J!UM gives you the overview and tools you need for components, modules, plugins and templates.