Joomla 3 and Joomla 4 no longer receive security patches. Infyways upgrades your site to Joomla 6.2, the latest release, or Joomla 5 on a staging copy, rebuilds the extensions that block the move, and carries your URLs and rankings across. Start with a free compatibility audit and a fixed written quote.
Joomla 3 or 4 to Joomla 5 or 6
Abandoned extensions rebuilt, not just replaced
Staging-first: your live site stays up
SEO-safe URLs and 301 redirects
PHP 8.1+ for Joomla 5, PHP 8.3+ for Joomla 6
Fixed written quote before work starts
October 2026 PHP security release
Why upgrading Joomla 3 can't wait.
On 21 October 2026, PHP released emergency fixes for two critical flaws (CVE-2026-109618 and CVE-2026-109619) that can let an attacker run code on a server without logging in. The fixes ship only in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Joomla 3 can't run on any of them, so for a Joomla 3 site the lasting fix is an upgrade to Joomla 6.2. Our PHP2Shell patch guide for Joomla and WordPress covers the server-side steps.
The fix only exists for PHP 8.2 and newer
PHP 8.1 and older no longer get updates from the PHP project. For PHP 7.4, 8.0 and 8.1 the security team released minimal source patches only, for people who compile PHP themselves (PHP security advisory). Unless your host or Linux vendor ships a backport, an older PHP server stays exposed.
Joomla 3 can't move up to a patched PHP
Joomla 3.10 was built for PHP 8.0 and doesn't work correctly on anything newer than PHP 8.1 (Joomla Community Magazine). Raising PHP to a fixed version breaks the site. Keeping the old PHP leaves the flaws open. Joomla 3 itself has had no security fixes since August 2023.
Joomla 6.2 runs on patched, supported PHP
Joomla 6 requires PHP 8.3 or newer (technical requirements), a branch that received the fix in 8.3.36. PHP 8.3 has security support until 31 December 2027, PHP 8.4 until 2028 and PHP 8.5 until 2029 (PHP supported versions), and Joomla 6 gets security fixes until October 2029.
We work with organisations whose Joomla site drives revenue, leads or reputation.
Business owners and marketing teams still on Joomla 3.x or 4.x, often after their host warns that old PHP is going away.
Online stores on VirtueMart where catalogue, checkout, tax and payment flows have to work on day one.
Sites with K2, custom components or an unmaintained template. These are the usual reasons a DIY upgrade stalls.
Education, non-profit and public-sector sites that face security reviews and need a documented, staged process.
Agencies and in-house IT teams that need a dependable upgrade partner for client sites. See our Joomla outsourcing services.
Support windows
Why upgrade Joomla now.
The Joomla Project publishes fixed support windows for every major version (official roadmap).
Joomla support windows
Version
Status
Support
Joomla 3
Unsupported
End of life since 17 August 2023. No security fixes.
Joomla 4
Unsupported
Security support ended in October 2025.
Joomla 5
Winding down
Security-only since October 2026. Security fixes until 12 October 2027.
Joomla 6
Supported
Current major release. Latest version 6.2 (October 2026). Security fixes until 16 October 2029.
Joomla 3
Status
Unsupported
Support
End of life since 17 August 2023. No security fixes.
Joomla 4
Status
Unsupported
Support
Security support ended in October 2025.
Joomla 5
Status
Winding down
Support
Security-only since October 2026. Security fixes until 12 October 2027.
Joomla 6
Status
Supported
Support
Current major release. Latest version 6.2 (October 2026). Security fixes until 16 October 2029.
Unpatched vulnerabilities
New flaws in Joomla 3 or 4 will never be fixed.
PHP will force the issue
Joomla 6 requires PHP 8.3 or newer and Joomla 5 requires PHP 8.1 or newer (technical requirements). As hosts retire old PHP versions, a Joomla 3 site can stop loading with fatal errors overnight.
Extensions have moved on
Major extensions such as Akeeba Backup, JCE and VirtueMart now target Joomla 4 and later, so security updates for your add-ons stop too.
Security and compliance reviews
If you take card payments, PCI DSS expects known vulnerabilities to be patched. That is hard to show on a CMS that no longer gets patches.
The gap only gets bigger
A Joomla 3 site already needs three major-version hops.
Upgrade paths
Joomla upgrade paths we handle.
Joomla doesn't support skipping major versions, so every upgrade follows the official route. We run all the hops on staging as one project, under one fixed price.
Upgrade paths by current version
Current version
Target
Route on staging
Complexity
Joomla 1.5 / 2.5
Joomla 5 or 6
Content and data migration into a fresh install
High
Joomla 3.x
Joomla 5 or 6
3.10 → 4.4 → 5.4 → 6
Medium
Joomla 4.x
Joomla 5 or 6
4.4 → 5.4 → 6
Medium
Joomla 5.x
Joomla 6
5.4 → 6
Low
Joomla 1.5 / 2.5
Target
Joomla 5 or 6
Route on staging
Content and data migration into a fresh install
Complexity
High
Joomla 3.x
Target
Joomla 5 or 6
Route on staging
3.10 → 4.4 → 5.4 → 6
Complexity
Medium
Joomla 4.x
Target
Joomla 5 or 6
Route on staging
4.4 → 5.4 → 6
Complexity
Medium
Joomla 5.x
Target
Joomla 6
Route on staging
5.4 → 6
Complexity
Low
Joomla 3 to 5 or 6
The core hops are routine. The work we quote is extensions that were never ported, templates built on Bootstrap 2 (Joomla 4 and later use Bootstrap 5), and old code that calls removed APIs such as JRequest. We fix or replace each blocker on staging before your live site is touched.
Joomla 4 to 5 or 6
Joomla 4 sites usually move faster. We still run an extension audit, raise PHP, and set the Behaviour - Backward Compatibility plugins correctly so the Joomla 6 updater is not blocked.
Joomla 5 to 6
The lowest-risk path. We update to 5.4, clear deprecated code flagged by the pre-update check, raise PHP to 8.3+, and complete the hop on staging before cutover.
Legacy Joomla 1.5 and 2.5
These sites can't be upgraded in place. We build a clean Joomla 5 or 6 install, migrate articles, categories, users and menus, rebuild the template, and 301-redirect every old URL. Scoped individually after the audit.
Migration services
Beyond the core upgrade.
Most upgrade quotes stop at "core plus compatible extensions". We also handle the parts that break.
Templates and design
We refactor your existing template for Joomla 5 or 6 so the site looks the same, or rebuild it when the old framework can't be saved.
When an extension has no Joomla 5 or 6 version, most providers swap in a "similar" one. We usually keep the feature your business relies on by rebuilding it.
We upgrade VirtueMart with the Joomla core and re-test the catalogue, product pages, cart, checkout, tax rules, shipping, payment gateways and order history before cutover.
K2 content is a frequent reason Joomla 3 sites get stuck. We migrate K2 items, categories, tags and images into Joomla articles, with redirects from the old K2 URLs.
Six steps, from a free audit to a reviewed go-live. Nothing touches your live site until you approve the staging copy.
01
Scan and audit
We scan your site (or review your System Information export), list blockers, and send a written compatibility report with a fixed quote.
02
Backup and staging
We take a full backup of files and database, confirm it restores, and build a private staging copy. Your live site keeps running untouched.
03
Extension and template compatibility
Every extension, plugin, module and template override is checked. We update, replace or rebuild anything that is not compatible with Joomla 5 or 6.
04
Upgrade along the official path
We run each supported hop on staging, check the database schema after each one, and fix errors as they appear so you only review and launch once.
05
Testing and your review
We test key pages, forms, logins, search and checkout (when applicable), then hand you the staging site to review. Nothing goes live until you approve it.
06
Go-live and SEO checks
We cut over in a low-traffic window you choose, then verify URLs, redirects, titles, canonicals and the XML sitemap.
Timelines
Typical Joomla upgrade timeline.
Most paid upgrades finish in days, not months. Your audit report includes a site-specific schedule for your time zone.
Typical upgrade timeline by site type
Site type
Typical timeline
What drives the schedule
Small business / blog (10–20 pages)
2–4 business days
Core path, few extensions, template still maintained
Medium site (extensions, store, 100+ pages)
5–8 business days
Extension updates, SEO checks, staging review cycles
Enterprise / ecommerce / legacy 1.5–2.5
10+ business days
Custom rebuilds, catalogue or K2 data, phased cutover
Small business / blog (10–20 pages)
Typical timeline
2–4 business days
What drives the schedule
Core path, few extensions, template still maintained
Medium site (extensions, store, 100+ pages)
Typical timeline
5–8 business days
What drives the schedule
Extension updates, SEO checks, staging review cycles
Enterprise / ecommerce / legacy 1.5–2.5
Typical timeline
10+ business days
What drives the schedule
Custom rebuilds, catalogue or K2 data, phased cutover
Before you upgrade
Joomla upgrade risk checklist.
The failure points we check on every Joomla 3/4 to 5/6 project. Skipping any of them is how DIY upgrades stall or lose SEO.
URLs and SEO
Changed aliases, missing canonicals or a regenerated sitemap can drop rankings overnight. We keep working URLs where possible and map every change before cutover.
Redirects
Old menu items, K2 item IDs and third-party SEF rules often break. We build a redirect plan and verify 301s after go-live.
K2 content
K2 is not Joomla 5/6 compatible. Items, categories and media need a planned migration path, not a core upgrade alone.
Templates and overrides
Legacy templates and layout overrides fail on newer Joomla and PHP. We test the front end on staging and rebuild overrides when required.
Custom and abandoned extensions
Unmaintained components are the usual blocker. We update, replace or rebuild them so the upgrade path can complete.
Your free audit lists which of these apply to your site before you approve a fixed quote. Hit an error mid-upgrade? See how to fix Joomla upgrade errors.
Every cutover gets senior review from Abhilash Sahoo, who has led Infyways' Joomla work since 2010. Complex blockers (abandoned extensions, custom components, PHP bumps, SEO redirects) are reviewed before cutover.
Fixed-price quote in writing after the free compatibility audit.
Staging-first cutover with a verified backup.
Prefer no admin login? Send your System Information export and extension list. We can quote without credentials.
The same scope at every tier: price clarity, staging discipline and a senior-reviewed cutover.
01
A fixed price, agreed in writing
You approve a written quote after the free audit, before any work starts.
02
A verified full backup and a rollback plan
Files and database are backed up and the backup is confirmed to restore before we touch anything.
03
A staging-first upgrade on the official path
Every hop runs on a private staging copy, with your live site up the whole time.
04
A compatibility review of every extension and template
Plus a PHP and database check for your host, so nothing is discovered on launch day.
05
Security patches, hardening and SEO-safe URLs
Basic hardening on the new version, with existing URLs kept and 301 redirects for anything that changes.
06
QA, your review and 30 days of support
You review staging before go-live, then get 30 days of post-launch support for anything tied to the upgrade, with optional ongoing Joomla support and maintenance afterwards.
Pricing
Joomla upgrade pricing.
Your audit ends in a fixed, written quote. These published tiers show where most projects land.
All work happens on staging, so your live site runs as normal. Once you approve, we sync the latest production data and switch over in a planned window. Stores and membership sites get a short, agreed content freeze so no orders are lost.
URL inventory before we start, so we know every page Google has indexed.
Same SEF URLs and menu aliases wherever possible. Anything that must change gets a 301 redirect.
Metadata carried over: titles, meta descriptions, canonical tags, robots settings and structured data.
XML sitemap and robots.txt regenerated and checked on the new version.
Post-launch checks for 404s and redirect chains during the support window.
Want to grow rankings, not just protect them? Our Joomla SEO services team works on the same codebase.
Case studies
Joomla upgrade results from real projects.
Named projects, version paths and delivery timelines from Infyways upgrade work.
Education · United States
GeekyGuru: education LMS, Joomla 3.10 to Joomla 5
Challenge
A US education site on Joomla 3.10 and PHP 7.3, with security warnings, about 30,000 monthly visits, and a login popup plugin that had no Joomla 5 release.
Result
We staged the Joomla 5 upgrade with JoomLMS and current extensions, and built Easy Login to replace the abandoned plugin. It took three working days to prepare and a weekend cutover of about four hours.
~30,000 monthly visits preserved
Abandoned login plugin replaced
~4-hour weekend cutover
Furniture ecommerce · Slovakia / Czech market
Estilofina: VirtueMart furniture store
Challenge
A furniture retailer with thousands of products on Joomla and VirtueMart needed a safer, modern stack and faster catalogue pages.
Result
We completed the VirtueMart and Joomla upgrade plus speed work in 10 days, kept the full catalogue, and re-tested every checkout path.
Our free Joomla migration scanner and migration reference show what will break on Joomla 6 before you talk to anyone. The scan runs in your browser, so your code is never uploaded.
Typical upgrade offer compared with Infyways
Topic
Typical upgrade offer
Infyways
Unsupported extensions
Replaced with an alternative, or removed
Rebuilt when needed, by a team that publishes its own extensions on the JED
Proof before you pay
A sales call
Free migration scanner plus a written audit report
SEO
Mentioned, not planned
URL inventory, 301 map and post-launch checks
Who does the work
Often one freelancer
A Joomla team, with senior review before every go-live
Pricing
“From” price, details later
Published tiers, then a fixed written quote
Unsupported extensions
Typical upgrade offer
Replaced with an alternative, or removed
Infyways
Rebuilt when needed, by a team that publishes its own extensions on the JED
Proof before you pay
Typical upgrade offer
A sales call
Infyways
Free migration scanner plus a written audit report
SEO
Typical upgrade offer
Mentioned, not planned
Infyways
URL inventory, 301 map and post-launch checks
Who does the work
Typical upgrade offer
Often one freelancer
Infyways
A Joomla team, with senior review before every go-live
Pricing
Typical upgrade offer
“From” price, details later
Infyways
Published tiers, then a fixed written quote
“Infyways upgraded our Joomla site without any downtime. They handled everything, from backups to testing.”
Education client, United States
Our playbook is public
Prefer to do it yourself?
These guides match the playbook we use on client upgrades. Stuck partway? Send us where you are and we'll quote the rest.
Joomla upgrade services at Infyways start from $149 for small sites of 10 to 20 pages. Medium, enterprise, ecommerce and legacy Joomla 1.5/2.5 projects are quoted after the free compatibility audit as a fixed written price, so there are no hidden fees.
02How long does it take to upgrade Joomla 3 to Joomla 5?
Most upgrades take 2 to 8 business days. Small sites usually take 2 to 4 days and medium sites with extensions or a store 5 to 8 days. Legacy or enterprise projects can take 10 days or more. Your audit report includes a specific timeline.
03Can I upgrade Joomla 3 directly to Joomla 5 or Joomla 6?
No. Joomla requires each major version in sequence: 3.10 to 4.4, then 5.4, then 6. We run every hop on a staging copy as a single project, so you only review and launch once.
04Will my website go down during the Joomla upgrade?
No. All work happens on a staging copy while your live site keeps running. Go-live is a planned switch in a low-traffic window you choose. Sites that take orders or registrations get a short, agreed content freeze so no data is lost.
05Will upgrading Joomla hurt my SEO rankings?
Not when it's planned properly. We keep existing URLs wherever possible, 301-redirect anything that changes, carry over titles, meta descriptions and canonical tags, regenerate the XML sitemap, and check for 404s after launch.
06What happens to extensions that don't support Joomla 5 or Joomla 6?
We update them if a compatible version exists, replace them with a maintained alternative if that makes more sense, or rebuild them for clients whose vendors disappeared.
07Should I upgrade to Joomla 5 or Joomla 6?
For most sites, Joomla 6, because it receives security fixes until October 2029, compared with October 2027 for Joomla 5. If a critical extension isn't Joomla 6-ready, we move you to Joomla 5.4 first and plan the Joomla 6 step later.
08Do I need to give you admin access for the free audit?
No. Your site URL, current Joomla version, extension list and a System Information export are enough for a compatibility report and fixed quote. We only need access once you approve the work.
09Can I keep Joomla 3 and just update PHP?
No. The October 2026 PHP security fixes (PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12) only exist for PHP 8.2 and newer, and Joomla 3.10 doesn't work correctly above PHP 8.1. Staying on older PHP leaves the two critical flaws open unless your host ships a backported fix, and Joomla 3 itself has had no security fixes since August 2023. Upgrading to Joomla 6.2 moves the site onto a patched, supported PHP branch.
10What if I hit an error mid-upgrade?
Stop and restore from backup before you force another hop. Common failures include pre-update check blocks, PHP fatals, database schema errors and a blank admin. See how to fix Joomla upgrade errors, or send us where you stalled for a fixed quote to finish the migration.
Related services
Joomla services that sit next to an upgrade.
The work teams usually need before, during or after a Joomla upgrade.
