Global Configuration

Global Configuration is a form over a single file. Almost every field on the Site, System, Server and Logging tabs is stored as a public property of the JConfig class in configuration.php in the site root. When a Super User presses Save, com_config merges the posted data with the current values and rewrites the whole file. The Text Filters and Permissions tabs are different: they are not written to configuration.php but to the database, as parameters of the com_config row in #__extensions (the text filters) and as rules in the root asset of #__assets (the permissions).

Three consequences follow from that design:

The screen needs the Configure permission (core.admin) on the root asset, which only Super Users have by default. The fields are defined in administrator/components/com_config/forms/application.xml in the source tree, and the saving code is in the ApplicationModel class of the same component. Reading the model explains several behaviours that surprise administrators:

Source: Joomla User Guide: Global Configuration

The Site tab holds the identity of the site and the defaults for list screens.

Pitfalls on this tab: turning on Use URL Rewriting without renaming htaccess.txt to .htaccess (or adding the equivalent nginx rule) makes every page except the home page return a 404; and a Default Editor set to a disabled editor plugin leaves article fields as plain textareas.

Source: Joomla User Guide: Global Configuration

The System tab combines the debug settings, the cache settings, the session settings and the optional help server.

The Server tab groups paths, error reporting, compression, HTTPS, locale, proxy and mail settings.

Error Reporting offers four values. default leaves PHP’s own error_reporting untouched, so the result depends on php.ini. none turns reporting off. simple reports errors and warnings, and maximum reports everything including notices and deprecations. A production site uses none, or default when the server’s php.ini already hides errors and writes them to a log. The maximum value shows file paths and sometimes query text to visitors and is for local development only.

Gzip Page Compression is usually better done by the web server, which compresses static files as well as pages and does it faster. Enabling both is harmless but wasteful, and enabling PHP compression behind a proxy that already compresses can double-encode a response if the headers are rewritten. Leave it off when Apache (mod_deflate) or nginx (gzip on) already compresses HTML, CSS and JavaScript, and turn it on only on a host where you cannot change the web server.

Force HTTPS redirects plain HTTP requests to HTTPS: Administrator only for the back end, Entire site for everything. Production uses Entire site. A site behind a reverse proxy or load balancer that terminates TLS needs Behind a Load Balancer switched on (or the proxy configured to send the standard forwarded headers); otherwise Joomla sees plain HTTP on every request and redirects forever. Redirects done in the web server (an HTTP to HTTPS rule and an HSTS header) are cheaper, and Web Server, Reverse Proxy and HTTPS covers them.

Mail is configured here too. The guide recommends trying PHP Mail first, then Sendmail, then SMTP, with the Send Test Mail button to confirm. For SMTP set the host and port (25 without security, 465 with SSL/TLS or 587 with STARTTLS), the security mode (none by default), and turn on authentication only when the server needs it. Gmail needs an app-specific password, and the OpenSSL PHP extension must be enabled; the guide also describes sending mail with OAuth 2.0. Outgoing Mail (mailonline) switched off silently stops all mail, which is a common reason for "password reset mails never arrive". Templates are in Mail Templates and Email Settings.

Source: Joomla User Guide: SMTP mail and Gmail

The Logging tab controls what Joomla writes to the log folder (log_path, /administrator/logs by default; outside the web root in a hardened install, see the path suggested in the Path to Log Folder field).

Only errors that Joomla itself traps are logged; the web server and PHP error logs may hold more. Log files are plain PHP files starting with a guard line so they cannot be downloaded, but they should still be kept out of the web root and rotated.

Source: Joomla User Guide: Global Configuration

Text filters decide which HTML a user may keep when they save content from an editor field. The tab lists every user group, and each group gets one filter type:

When a user belongs to several groups, Joomla combines the groups' settings in the user’s favour, so one lenient group cancels a strict one: removing a user from a privileged group is the way to restrict them. Super Users are typically left on No Filtering, which is why content written by a Super User can contain a script that the same text submitted by an Author would lose. Treat that as a reason to limit the Super User group and to review third-party content pasted by administrators.

Internally the posted filter table is stored in the parameters of the com_config extension row and not in configuration.php. The component that saves the content (articles, contacts, custom fields) then applies the filter to the fields marked as HTML, using the Joomla\CMS\Filter\InputFilter class (a thin layer over the joomla/filter library, which in 6.2 is version 4.1). The filter also decodes and sanitises base64-encoded SVG data URIs inside attributes. Because the filter runs when content is saved, changing a group’s filter does not clean content that is already stored.

The Permissions tab sets the rules on the root asset, which every other asset (components, categories, items) inherits unless it overrides them. Each user group is a row; each action (Site Login, Administrator Login, Offline Access, Super User, Access Administration Interface, Create, Delete, Edit, Edit State, Edit Own, and so on) is a column with Inherited, Allowed or Denied. Denied always wins over Allowed, and a Denied set on a parent cannot be overridden below it. The calculated setting shows whether the result is allowed, not allowed or locked.

The Permissions rules are stored in #__assets. Note that the Super User action is the one that makes a group unrestricted: grant it only to a dedicated group. The model and the rules for the Trail Warden group are explained in Users, Groups, Access Levels and ACL.

Edit the file directly only when the screen is unavailable, and remember that Joomla keeps it read-only (0444). The CLI is safer than an editor, because it validates and writes the file the same way as the screen:

Source: Joomla User Guide: Using the CLI

A trimmed production configuration.php for the Tallpine site looks like this. The credentials are placeholders: the real values are never committed and the file is created from a template at deployment.

Source: Joomla CMS source: configuration.php-dist

The default dbprefix is generated randomly by the installer; a custom prefix is only hard to guess, not a security control. The secret is used for signing and must differ per environment, and never be copied from staging to production or committed.