Skip to main content

How to Add Users and Set Permissions in Joomla

Using WordPress instead? See How to Add Users and Set Roles in WordPress.

Giving each person their own login, with only the access they need, keeps your site safer and makes it easier to see who changed what.

How Joomla permissions work

  • User groups control what someone can do, like create, edit, or publish articles, or log in to the admin.
  • Access levels control what someone can see on the front of the site, like Public or Registered-only pages.

Joomla's default groups are Public, Guest, Registered, Author, Editor, Publisher, Manager, Administrator, and Super Users; your site may have custom ones. The ones you'll assign most often:

  • Author: can write articles from the front of the site.
  • Editor: can also edit others' articles.
  • Publisher: can also publish.
  • Manager: can use the admin for content.
  • Administrator: broad admin access.
  • Super Users: full control. Keep this to as few people as possible.

Permissions for each group are set under System > Global Configuration > Permissions, and many sites adjust them, so check with your web team before changing them.

Add a user

  1. Log in at yoursite.com/administrator.
  2. Go to Users > Manage and click New.
  3. On Account Details, enter Name, Login Name, Email, and a Password (and Confirm Password). You can set Require Password Reset to Yes so they choose their own at first login.
  4. On Assigned User Groups, tick the group(s) that match the access they need.
  5. Click Save & Close.

Send them their login details through a secure channel, not in the same email as the password.

Change someone's access

Open the user in Users > Manage, change their Assigned User Groups, and save.

Remove former staff

Do this as soon as someone leaves.

  • Block them: open the user and set User Status to Blocked. Their account and history stay, but they can't log in.
  • Delete them: tick the user in Users > Manage and click Delete. Articles they created stay on the site.

Blocking is often the safer first step. Also change any shared passwords they knew, like hosting or FTP.

Turn on multi-factor authentication

Joomla includes multi-factor authentication. Each user sets it up in their own profile, on the Multi-factor Authentication tab. Encourage everyone with admin access to turn it on.

Review users regularly

A few times a year, go through Users > Manage and remove or block accounts that aren't needed.

Related

Prefer we handle it?

If you'd rather spend your time running your business, our boutique hosting, available to our clients, including sites moved over from another host, takes a proactive approach to security and monitoring, with nightly backups, 24/7 outage monitoring, and ongoing core CMS updates.

Joomla