How to Manage Joomla User Permissions and Access Levels (ACL Guide)

🖼️ [SCREENSHOT NEEDED] Hero image: Joomla administrator Users menu open, showing "Groups", "Access Levels", and "Manage" options.

One of Joomla's strongest features is its Access Control List (ACL) — it lets you decide exactly what each person can see and do on your site. Set it up carelessly, though, and it becomes one of the easiest ways to accidentally lock yourself out or leave a security hole open. This guide walks through how Joomla's ACL actually works, how to create a custom role safely, and the habits that keep permissions clean as your team grows.

📋 What You'll Need

Requirement	Details
Joomla version	Joomla 4.x, 5.x, or 6.x — the ACL screens covered here are the same across all three
Access level	Super User (administrator) login to the backend
Planning	A short list of the actual roles/teams on your site (e.g., "Support Staff", "Guest Contributors")
Optional	Two-Factor Authentication plugin enabled; a security extension such as Admin Tools if you plan to run permission audits

What Is ACL in Joomla, and How Does It Work?

Joomla's ACL defines who can do what, and where. It runs on three connected pieces:

Element	What it controls	Example
User Group	Who the user is and what actions they can perform	Author, Editor, Manager
Access Level	What content a group of users is allowed to view	"Registered" access level on a members-only article
Permission	The specific action a group can take on an item	Create, Edit, Edit Own, Delete, Publish

Joomla's Default User Groups Explained

A fresh Joomla install ships with a hierarchy of built-in groups, each inheriting the permissions of its parent group:

Group	What it can do
Public	Anyone visiting the front end of the site, logged in or not
Registered	Logged-in front-end users; no content creation rights by default
Author	Can create and edit only their own articles
Editor	Can edit any article on the site, not just their own
Publisher	Can edit any article and control publish/unpublish state
Manager	Backend access limited mainly to content management
Administrator	Full backend control except Global Configuration; cannot modify Super Users
Super User	Unrestricted access to every part of the site

How to Create a Custom User Group and Access Level

Use this when none of the default groups fit — for example, a support team that should edit articles but never touch site configuration.

Step 1: Create the custom user group

1. Go to Users → Groups → New.
2. Give it a descriptive name, e.g., "Support Staff".
3. Select a parent group — usually "Registered" for front-end-only roles, or "Manager" if the role needs some backend access.
4. Click Save & Close.

🖼️ [SCREENSHOT NEEDED] Joomla admin: Users → Groups → New, with the "Group Name" field and "Parent Group" dropdown circled in red.

Step 2: Create a matching access level

1. Go to Users → Access Levels → New.
2. Name the access level to match its purpose, e.g., "Support Staff Only".
3. Under "Groups", tick every user group that should be able to view content set to this access level.
4. Click Save & Close.

🖼️ [SCREENSHOT NEEDED] Joomla admin: New Access Level screen with the group checkboxes ticked, circled to show which groups were selected.

Step 3: Assign the access level to content

1. Open the article, module, or menu item you want to restrict.
2. In the Publishing tab, find the Access dropdown.
3. Select the access level you just created, then save.

🖼️ [SCREENSHOT NEEDED] Joomla article editor, Publishing tab, with the "Access" dropdown open and the custom access level highlighted.

Best Practices for Super User Accounts

• 🔐 Keep a dedicated Super User account used only for configuration or updates — don't use it as a daily-driver login.
• 📧 Set an admin-only email on Super User accounts and enable Two-Factor Authentication (2FA).
• 🚫 Never share Super User credentials between people — create a separate account per admin instead.

Review Permissions Regularly

Permissions drift as teams change. Set a recurring reminder — every 1–3 months — to:

• Remove accounts for people who've left the team.
• Downgrade roles that no longer need their current access.
• Run a permission audit with a security extension such as Admin Tools.

Restrict Backend Access

Only grant backend login (Manager group or higher) to people who actually need it. For an extra layer, restrict backend login by IP address or use a firewall/security plugin to limit where login attempts can come from.

Track User Actions with Joomla's Audit Log

Joomla ships with a built-in audit trail: go to Users → User Actions Log (only visible to Super Users) to see logins, content changes, and extension installs. For centralized monitoring across multiple sites, an external service such as Watchful.net can add alerting on top of this.

❓ Frequently Asked Questions

What's the difference between a user group and an access level in Joomla?

A user group controls what actions someone can perform, like creating or editing content. An access level controls what content a group is allowed to see. Both work together, but they answer different questions.

How many Super User accounts should a Joomla site have?

As few as possible. Most sites only need one or two, each tied to a specific person, with 2FA enabled and used only when Super User-level access is actually required.

Can a user belong to more than one group in Joomla?

Yes. Joomla lets a user belong to multiple groups at once, and they inherit the combined permissions of every group they're a member of.

How do I see what changes a user made on my Joomla site?

Go to Users → User Actions Log in the backend. It records logins, content edits, publishing changes, and extension installs, and only Super Users can view it.

Do I need a custom user group, or can I just use the defaults?

Use the defaults whenever they fit. Create a custom group only when a role needs a permission combination — like editing articles but never touching configuration — that no default group offers.

🧯 Common Mistakes to Avoid

• Confusing groups with access levels. Creating a group but forgetting to also create and assign a matching access level means content still isn't restricted.
• Defaulting to Manager or Administrator. It's tempting to hand out a built-in group that's "close enough" instead of creating the right custom one — this over-grants access.
• Skipping 2FA on Super User accounts. These are the highest-value accounts to attackers; they should be the most protected, not the least.
• Forgetting to apply the access level. A new access level does nothing until it's actually selected in an article's, module's, or menu item's Access field.
• Never revisiting old accounts. Ex-employees and inactive contributors left in Manager or higher groups are a common, avoidable security gap.

➡️ What's Next

Once your user permissions are locked down, the next place to check is your file and folder permissions — misconfigured file access is another common way Joomla sites get compromised.

✅ Last verified on Joomla 6.1 — July 2026