Joomla Menus and Menu Items

This content was generated with the assistance of AI and should be verified against the official Joomla documentation before being relied on in production.

This sub-section’s Joomla bibliography lists the reference material consulted while preparing these pages.

Menus are the part of Joomla that most surprises people coming from other systems. A menu item is not just a link in a navigation bar: it is the unit that decides which component and view answer a URL, which parameters that view receives, which template style and modules are used, who may see the page and in which language. This page explains menus and menu items in depth, from the screens a site builder uses to the #__menu table and the router classes underneath. It was checked against the official documentation on 2026-10-30 and refers to Joomla 6.2 (the current release, requiring PHP 8.3 or newer). Menu handling is stable across 4.x, 5.x and 6.x, and the text points out the few differences. Joomla 5.4 only receives security fixes; Joomla 4.x and 3.x are end of life (see Versions, Release Cycle and Support).

The examples belong to the Tallpine Hiking Club, a fictitious mountain club whose site is described in Joomla Introduction and Architecture: trail reports in the nested categories Trails > Alpine and Trails > Valley, news, a board of contacts, a member-only area for the Trail Warden group, and English and German versions.

Menus, menu items and menu modules

Three different things share the word "menu", and keeping them apart removes most of the confusion:

Thing What it is Where it lives

Menu (menu type)

A named container of menu items, for example main-menu or trails-menu. It has a Title, a Unique Name (the internal identifier, hyphens allowed, no spaces) and an optional Description. A menu does nothing visible by itself.

Table #__menu_types; Administrator: Menus > Manage.

Menu item

One entry of a menu. It stores a link (index.php?option=...&view=...), a type, a parent, an alias, an access level, a language and a set of parameters. Menu items exist even if no menu module ever displays them.

Table #__menu; Administrator: Menus > <menu name> or Menus > All Menu Items.

Menu module

A module of type Menu (mod_menu) that renders the items of one menu in a template position, for example main-menu in the menu position of Cassiopeia.

Table #__modules with module = mod_menu; Administrator: Content > Site Modules.

The consequences are practical:

  • A menu item works without a menu module. A hidden menu (no module) is a common way to give a page a clean URL and parameters without showing it in any navigation. The User Guide states the same: the menu module can be created when the menu is created or later, and menu items can be added before the module exists.

  • A menu module can be shown without any menu items being routed to a particular page. Displaying a menu does not "enable" its pages; the items themselves carry the routing information.

  • One menu can be shown by several menu modules (for example a full dropdown in the header and a flat copy in the footer), and a module can show only part of a menu (start level, end level, base item).

  • Unpublishing a menu module hides the navigation but leaves every URL of the menu working. Unpublishing or trashing a menu item makes its URL stop resolving. Mixing these two up is a classic cause of unexpected 404 errors.

Creating a menu and its module

In the Administrator, open Menus > Manage and select + New. Complete Title, Unique Name and Description, then Save & Close. In the menu list, Add a module for this menu opens the module form: give it a Title, decide whether to Show Title, check that Select Menu shows the new menu and choose a Position (see Modules and Positions for the positions Cassiopeia offers). Menu modules also have an Advanced tab with a Layout: Default suits side menus, with child items indented, and Dropdown suits top menus, with child items in drop-down lists.

Source: Joomla User Guide: Adding a New Menu

The Tallpine site uses four menus:

Unique Name Module position Purpose

main-menu

menu (header)

Home, Trails (heading with Alpine and Valley underneath), News, About us, Contact, Members

footer-menu

footer

Privacy, Imprint, Site map, Search

members-menu

sidebar-right

Trail conditions, my profile, log out (shown only to registered members)

hidden-menu

none

Items that only exist to carry routing parameters (the search results page, the login form, the registration form)

Where the data is stored

Every menu item is a row in #__menu (the prefix is replaced by the one chosen at installation). The columns that matter for routing are listed below. Queries against this table, using the database API, are covered in The Joomla Database API.

-- Illustrative, read-only query: which menu items route to the single trail report view?
SELECT id, menutype, title, alias, path, link, type, published, parent_id, level, access, language, home
FROM   #__menu
WHERE  client_id = 0
  AND  link LIKE 'index.php?option=com_content&view=article%'
ORDER  BY lft;

Source: Joomla Manual: Routing

  • menutype points to the menu (#__menu_types.menutype), client_id is 0 for Site menus and 1 for Administrator menus.

  • link stores the internal query string, type stores the kind of item (component, alias, url, separator, heading), and component_id stores the extension that owns a component item.

  • alias is the URL segment of the item and path is the full path of aliases from the top, for example trails/alpine. The router matches URLs against path.

  • parent_id, level, lft and rgt implement the nested tree (a nested set, like categories).

  • home is 1 for the default item, access holds the access level id, language holds * or a language tag, and params holds the JSON of every option described below, including template_style_id.

Editing this table by hand is a last resort. The nested set values (lft, rgt, path) must stay consistent, so create and move items in the Administrator or through the model classes.

Menu item types

Choosing the Menu Item Type is the first decision. It is made with the Select button on a new item and determines which component and view are called, which parameters are offered and which tabs the form shows. The User Guide groups the types by the component that provides them. The core has about ten such groups and over thirty types.

Group and type What it does

Articles > Single Article

Shows one article, chosen with Select Article. The right type for fixed pages such as "About us" or "Privacy".

Articles > Category Blog

Shows article introductions of one category (optionally with subcategories) in one or more columns. The Tallpine Trails > Alpine page uses it.

Articles > Category List

Lists the articles of a category as a table with sortable columns (title, date, hits, author). Good for archive-like pages.

Articles > Featured Articles

Shows the articles flagged as featured, from one or more categories, in a blog layout. The usual home page type.

Articles > Archived Articles

Shows archived articles, filterable by month and year.

Articles > List All Categories in an Article Category Tree

Shows the category tree, with links to each category.

Articles > Create Article

A front-end form to write an article, for users who are allowed to create content (see Users, Groups, Access Levels and ACL).

Contacts > Single Contact, List Contacts in a Category, Featured Contacts, List All Categories in a Contact Category Tree, Create Contact

Front-end pages for the contact component. The Tallpine board page is a List Contacts in a Category item; see Contacts, Banners and News Feeds.

News Feeds > Single News Feed, List News Feeds in a Category, List All Categories in a News Feed Category Tree

Display external RSS or Atom feeds.

Smart Search > Search

The results page of the Smart Search index (the default search results layout). See Smart Search.

Tags > Tagged Items, Compact List of Tagged Items, List All Tags

Lists of content with chosen tags, for example everything tagged family-friendly. See Categories and Tags.

Users > Login Form, Logout, Registration Form, User Profile, Edit User Profile, Password Reset, Username Reminder Request

Account pages. Logout logs the user out directly and redirects to a chosen page.

Privacy > Create Request, Confirm Request, Extend Consent

Forms for information requests and consent (see Privacy and Action Logs).

Configuration > Site Configuration Options, Display Template Options

Front-end forms to edit global settings or template parameters for authorised users.

Wrapper > Iframe Wrapper

Displays a URL inside an iframe.

System Links > URL

Links to an external or internal address. No component is involved.

System Links > Menu Item Alias

Points to another menu item.

System Links > Separator

A divider between items, optionally with a text label.

System Links > Menu Heading

A non-clickable heading that groups child items.

Source: Joomla User Guide: Menu Item Types

Third-party components add their own types. A component supplies its types from the XML files in the tmpl folder of its views (default.xml and layout XML files), which declare the title, the description and the request parameters. The Tallpine component com_tallpine adds Trail List and Single Trail in this way; building them is covered in Component Site Views and Routing.

Content types in practice

Single Article stores index.php?option=com_content&view=article&id=42. The article id is part of the link, so the item keeps working if the article is renamed, but it breaks if the article is deleted. Because the link is hard-wired, a single-article item is a poor choice for content that editors replace regularly; use a category blog or list and let editors publish new articles into the category.

Category Blog and Category List store view=category with a layout (blog or default) and the category id. The form adds the Blog Layout tab for the number of leading, intro and link articles, the columns and the ordering. A list also offers filters, pagination and the choice of columns on the Options tab. For the Trails section the Tallpine site creates one item per subcategory, so that each gets its own alias, metadata and module set.

Featured Articles does not select by category by default; it selects whatever carries the Featured flag (articles can also be featured for a limited time through Start Featured and Finish Featured). The Home item of the Tallpine site is a featured-articles blog filtered to the News category, so a trail report becomes a headline only when an editor marks it as featured.

The Single Contact, Featured Contacts and Category types of the contact component work like their article counterparts. Smart Search > Search is the result page that the search module posts to; it is normally placed in a hidden or footer menu, and the search module can point to it through its Set ItemID option.

System links: URL, alias, separator and heading

The four System Links do not call a component. They exist to shape navigation:

  • URL stores any address in link and has no routing role. It can point to an external site (a partner shop of the club), to a file, or to an internal path such as index.php?option=com_users&view=login. Because nothing routes through it, internal links can drift when other items change; use a component item when the target is a Joomla page.

  • Menu Item Alias points to another menu item of any menu. Visiting its URL either shows the target’s content under the alias path or redirects to the target, depending on the redirect option of the alias. It is used to show the same page in two menus (the Tallpine "Contact the board" entry in the footer and in the main menu) without duplicate content, and to keep the target highlighted as the active item. The alias does not copy the target’s access level, so check both.

  • Separator is a divider, with an optional text label. It has no URL.

  • Menu Heading is a non-clickable grouping label for submenu items, for example Trails above Alpine and Valley. Like the separator, it has no page of its own, but its alias still forms the first segment of its children’s path.

Because a heading is part of the path, renaming its alias changes the URL of every child, and the old URLs return 404 unless redirects exist (see SEO, SEF URLs, Redirects and Schema.org).

Choosing a type: a decision aid

Need Type

A fixed page whose text rarely changes

Single Article

A section where editors keep adding trail reports

Category Blog or Category List

A home page with highlighted content

Featured Articles

A page for a list of tags

Tagged Items or List All Tags

A login or registration page

Users > Login Form or Registration Form

A search results page

Smart Search > Search

A link to a partner site, or to a file

URL

The same page in two menus

Menu Item Alias

A group of children without a page of its own

Menu Heading

A visual divider in a long menu

Separator

The Home item and languages

Exactly one menu item per language is the default page (Default Page set to Yes, shown as a star in the list). The default item is what the router uses when the URL has no path (https://tallpine.example/), and it is the fallback when a request carries no Itemid.

  • On a single-language site the default item has Language set to All.

  • On a multilingual site with the Language Filter plugin enabled, each content language needs its own Home item, with its Language set to that language and Default Page set to Yes. A site with English and German therefore has two home items, usually in two separate menus (main-menu-en, main-menu-de) and an additional All item that is rarely used. Without one per language, the language switcher cannot find a target and visitors see errors or the wrong home page.

  • The default item cannot be unpublished, trashed or deleted until another item takes over. To change the home page, open the new item and set Default Page to Yes, or use the star in the list.

  • The access level of the default item must allow public viewing; otherwise guests are sent to a login page for the front page.

The home item defines the site’s front page, which is why changing its Template Style, Page Display or module assignment affects the first impression of the whole site. The multilingual set-up in full is explained in Multilingual Sites.

The menu item form

The edit form of a menu item contains a Details area (always shown) and tabs whose set depends on the type. The User Guide names Options, Page Display, Link Type, Metadata and Module Assignment as tabs common to most types, and Blog Layout as specific to Featured Articles and Category Blog.

Source: Joomla User Guide: Menu Items

Details

  • Title is the name displayed in menus.

  • Alias is the URL segment. It is generated from the title if left empty and must be unique among siblings of the same parent and language. The Unicode Aliases option in Global Configuration allows non-Latin characters.

  • Menu Item Type (see above) and, for component types, the Link (read only).

  • Menu and Parent Item position the item in the tree; Ordering sets the order among siblings.

  • Status (published, unpublished, trashed), Start Publishing and Finish Publishing control visibility in time.

  • Target Window (Parent, New Window With Navigation, New Without Navigation) controls the browser window used.

  • Template Style assigns a template style to the item, or Use Default. Pages reached through this item are rendered with that style, which is how a landing page can use a different colour scheme or a child template. See Templates and Template Styles.

  • Default Page marks the home item (see above).

  • Access assigns an access level, Language assigns a language or All, and Note is an editor-only remark.

Link Type

The tab controls how the item is displayed inside a menu module: Link Title Attribute, Link Class (CSS classes added to the anchor, for example Bootstrap utility classes), Link Icon Class, Link Image with Image Class, Add Menu Title (show the title next to the image) and Display in Menu (set to No to hide the item from every menu module while keeping its route). The Display in Menu switch is the lightest way to create a hidden item without a separate hidden menu.

Page Display

These settings affect the page itself, not the navigation:

  • Browser Page Title overrides the <title> of the page; when empty, the item title (or the article title) is used.

  • Show Page Heading and Page Heading control the h1 rendered by the component.

  • Page Class appends a suffix class to the page container, a hook for CSS (the legacy Bootstrap 2 class name is kept for compatibility, so choose a suffix with a leading space).

  • Tab-specific Options decide how the content is rendered: whether to show titles, dates, authors, category links, hits, navigation and so on. These override the component’s global defaults, and in turn can be overridden by the article’s own options, so the chain to remember is component options, then menu item options, then article options.

Metadata

Meta Description, Keywords and Robots write the corresponding tags for the page. Older books, including Joomla! 4 Masterclass (2023), still recommend keyword lists and keyword density. Search engines have ignored the keywords tag for many years; fill in a short, unique meta description for each item and use Robots (noindex, follow) for pages such as the hidden search results. The Metadata of a category blog item also describes every page in that section, so write it for the section and not for one article. Schema.org output and canonical handling are covered in the SEO page.

Module Assignment

The tab lists every published module with the choice of showing it on this page or not (the same information is edited from the module side as Menu Assignment: On all pages, No pages, Only on the pages selected, On all pages except those selected). The two views edit the same table, #__modules_menu, which stores a module id and a menu id (a negative menu id means "all except"). Module assignment is why a sidebar module appears on the Alpine trail reports but not on the board page: the sidebar module is assigned to the Alpine and Valley items only.

A module assigned to a menu item appears on every page whose active menu item matches, including pages reached by links that do not carry the item in their path but resolve to it. That is another reason to keep the route-to-item mapping tidy. Position choices and module chromes are in Modules and Positions and Layouts and Module Chromes.

Associations, Permissions and Request variables

On a multilingual site an Associations tab links the item to its translations (the English "Trails" item to the German "Touren" item). A Permissions tab, per item, sets Delete, Edit and Edit State actions for groups; its inheritance rules are those of any Joomla asset (see Users, Groups, Access Levels and ACL). Some views, for example login and registration, add request parameters that are stored in the item’s params and in the Link (the link then contains view=login or view=registration).

How menu items drive routing

When a visitor requests a page, the Site application must turn the URL into a component, a view and the parameters of that view. The menu is the first stop of that translation. The Developer Manual describes the pieces: a router class that provides parse() and build(), rules attached with attachParseRule() and attachBuildRule(), and component routers that handle what the site router does not.

Source: Joomla Manual: Routing

flowchart TD U["URL: /en/trails/alpine"] --> L["Language Filter rule removes the en prefix and sets lang"] L --> M["SiteRouter matches path segments against menu item aliases"] M --> I["Active menu item: Category Blog Alpine, Itemid and path"] M -- "no alias matches" --> E["404 Not Found"] I --> A{"Access level and language allow this user?"} A -- "no, guest" --> LG["Redirect to login"] A -- "no, logged in" --> F["403 Forbidden"] A -- "yes" --> P["Link and params become request variables: option, view, layout, id"] P --> R["Remaining segments go to the component router"] R --> C["com_content dispatches the category view with the parameters"] C --> S["Template style from the menu item, or the default style"] S --> D["Modules assigned to the item for each position"] D --> T["Template index.php renders jdoc:include type=component and type=modules"]

The sequence in more detail:

  1. Base and entry point. The instance path and index.php are removed from the URL, leaving segments such as en/trails/alpine.

  2. Language prefix. When the Language Filter plugin is enabled, its rule recognises the language code, removes it from the segments and sets lang.

  3. Menu matching. The router compares the first remaining segment with the alias of a top-level menu item, then continues down the tree matching each following segment against child aliases. The deepest match is the active menu item. Its id becomes Itemid, the variables of its link (option, view, layout, id) are added to the request, and the item is set active. A 404 is raised when no top-level alias matches the first segment.

  4. Component router. Leftover segments are handed to the component’s router, which turns them into view parameters (for example an article alias below a category blog item). If segments remain after the component router has run, the result is a 404.

  5. Access and language checks. After routing, the access level of the active item is verified. A guest is redirected to the login page; a logged-in user without the level gets a 403 response.

  6. Dispatch and rendering. The component runs, the template style (item or default) is loaded, modules are selected through #__modules_menu, and index.php of the template renders the component and the module positions.

Source: Joomla Manual: Parsing an SEF URL

Building a URL goes the other way. A call such as Route::_('index.php?option=com_content&view=article&id=42&catid=9') asks the router to find the best menu item for the requested view and parameters, lets the component router produce the remaining segments, and prepends the menu item’s path. If no suitable item exists, the URL falls back to the component’s default form and may include the current Itemid. This is why the same article can have different URLs depending on the menus that exist, and why deleting or unpublishing an item changes every generated link that relied on it.

SEF settings

The Search Engine Friendly URLs option of System > Global Configuration > Site is on by default; Use URL Rewriting removes index.php from URLs and requires the web server rewrite rules (copy htaccess.txt to .htaccess on Apache, or use the configuration shown in Web Server, Reverse Proxy and HTTPS); Adds Suffix to URL appends .html. See Global Configuration. The Manual describes a feature added in Joomla 5.3: a router may flag a correctly parsed but imperfect URL (for example a missing .html suffix or an outdated id-alias segment) as tainted, after which the SEF system plugin issues a single 301 redirect to the canonical URL.

Source: Joomla Manual: Routing

Component routers and the menu

A component router declares its views and connects them to menu items with RouterView. The pieces named in the Developer Manual are RouterViewConfiguration (one per view, with setKey() and setParent()), registerView(), the segment and id callbacks (get<Viewname>Segment and get<Viewname>Id) and three rules: MenuRules chooses the menu item on which a built URL is based, StandardRules handles building and parsing when a menu item matches, and NomenuRules handles URLs when no item matches. The Tallpine component registers a list view and a trail view whose parent is the list:

<?php

namespace Tallpine\Component\Tallpine\Site\Service;

use Joomla\CMS\Application\SiteApplication;
use Joomla\CMS\Categories\CategoryFactoryInterface;
use Joomla\CMS\Component\Router\RouterView;
use Joomla\CMS\Component\Router\RouterViewConfiguration;
use Joomla\CMS\Component\Router\Rules\MenuRules;
use Joomla\CMS\Component\Router\Rules\NomenuRules;
use Joomla\CMS\Component\Router\Rules\StandardRules;
use Joomla\CMS\Menu\AbstractMenu;

defined('_JEXEC') or die;

final class Router extends RouterView
{
    public function __construct(SiteApplication $app, AbstractMenu $menu)
    {
        $trails = new RouterViewConfiguration('trails');
        $this->registerView($trails);

        $trail = new RouterViewConfiguration('trail');
        $trail->setKey('id')->setParent($trails);
        $this->registerView($trail);

        parent::__construct($app, $menu);

        $this->attachRule(new MenuRules($this));
        $this->attachRule(new StandardRules($this));
        $this->attachRule(new NomenuRules($this));
    }

    public function getTrailSegment($id, $query): array
    {
        return [(int) $id => (int) $id . '-trail'];
    }

    public function getTrailId($segment, $query): int
    {
        return (int) $segment;
    }
}

Source: Joomla Manual: RouterView

With a menu item of type Trail List called trails in the main menu, Route::_() for a trail produces /trails/12-trail. Without that menu item the NomenuRules produce a longer path built from the component name. The complete treatment of routers, including the segment callbacks and testing, is in Component Site Views and Routing.

Access, permissions and language of menu items

Access. The Access field of an item selects an access level (Public, Registered, Special, Guest, Super Users, or a custom level such as the Tallpine Trail Wardens level). The menu module hides items the current user may not see, and the router enforces the same level when the URL is requested directly. Two rules help avoid confusion:

  • The access level of a menu item and the access level of the article it displays are separate checks. An article may require a level that the menu item does not, and a user can see the item but get a 404 or an empty list for the article.

  • Check the access level of every item in a restricted section, not just of its heading. Each item is verified on its own when its URL is requested.

For the member-only trail conditions page of the club, create an access level that includes the Trail Warden group and select it in the Access field of the item. Guests who request the URL are redirected to the login page.

Permissions. The item’s Permissions tab controls who may edit, publish or delete the item in the Administrator. Editing menus is a powerful action: whoever can edit the home item or an alias controls what visitors see. Grant it narrowly (see the security section below).

Language. An item with Language set to a specific language is routed and listed only when the active language matches. With the Language Filter plugin enabled, menu modules show only the items of the active language and of All, and the Associations tab links translations so the language switcher can jump between them.

Practical examples

Creating menu items from the CLI and the API

Joomla ships no core command to create menu items. Create them in the Administrator, or call the Web Services API, which exposes menus and menu items as v1/menus/site and v1/menus/site/items (the generic routes added by com_menus). A read-only listing with an API token, supplied from the environment:

curl -s -H "X-Joomla-Token: ${TALLPINE_API_TOKEN}" \
     -H "Accept: application/vnd.api+json" \
     "https://tallpine.example/api/index.php/v1/menus/site/items?filter[menutype]=main-menu"

Source: Joomla User Guide: Menu Items

The token plugin is enabled by default on fresh 6.2 installs; see The Joomla Web Services API. The API does not make menu item routing safer: the rows it creates have the same effect on the live site as rows created in the Administrator.

Hidden menu items for the search and login pages

The Tallpine site places the search results page and the login form in hidden-menu, which has no module. Each item is created once, with Menu Item Type Smart Search > Search or Users > Login Form, Display in Menu is not needed because no module renders the menu, and the footer module mod_finder (or the search module) is told which item to use. The effect is a clean /search URL and a fixed template style and module set for that page.

Reading the active and default menu item in a layout

Template layouts and module dispatchers can ask the menu service which item is active and which is the default item of the current language. This is how a module such as mod_tallpine_nexthikes decides whether it runs on the home page:

<?php
// templates/cassiopeia_tallpine/html/layouts/tallpine/home-banner.php
defined('_JEXEC') or die;

use Joomla\CMS\Factory;

$app    = Factory::getApplication();
$menu   = $app->getMenu();
$active = $menu->getActive();
$lang   = $app->getLanguage()->getTag();

$isHome = $active !== null && $active->id === $menu->getDefault($lang)->id;

if ($isHome) {
    echo '<div class="tallpine-banner">Next group hike: Saturday</div>';
}

Source: Joomla Manual: Routing

getActive() returns null when no item is active (for example on some API or error responses), so test for it. Menu item overrides for the module layouts themselves are covered in Template Overrides and Alternative Layouts.

Common errors and pitfalls

  • 404 after moving a menu item. The path of the item and of all its children changes. Add redirects, or keep the alias of a moved heading unchanged. Check the aliases of headings, because they appear in every child URL.

  • Duplicate aliases. Two items with the same alias, parent and language are refused. Two items in different menus can produce conflicting paths when both are at the top level; use distinct aliases or nesting.

  • Wrong active item. If an article is reachable through several menu items, Joomla picks the best match when building links, which may not be the one visitors used. Use one item per section, or aliases to keep the active highlight.

  • No home per language. Enabling the Language Filter plugin before creating a default item for each language produces errors on the language switcher and on the front page.

  • Restricted home page. A home item that is not public sends every visitor to the login page.

  • Hidden by position. A menu item is "missing" because the menu module is unpublished, assigned to no pages, restricted by access level or language, or placed in a position the template does not render.

  • Trashed items. A trashed item stays in the table and may still occupy an alias; empty the trash after checking that no module or alias still refers to it.

  • Deleting a menu. Deleting a menu deletes its items. Modules that referred to it become empty.

  • Alias loops. A menu item alias that points at another alias, or back at itself, produces confusing redirects. Point aliases at real component items.

Security considerations

  • Treat menu editing as a privileged task. The Edit permission on menu items lets a user redirect traffic through a URL item, change the home page or the access level of a page, or assign modules to pages. Do not give it to authors.

  • A URL menu item is a stored link. Review links to external sites regularly and add rel="noopener noreferrer" through Link Class/Target Window rules where the template does not set them. A script-bearing URL is filtered, but links to untrusted sites remain a phishing vector.

  • Access level restrictions on menu items protect pages only through that route. Sensitive content must also be protected at the article, category or component level, because another menu item, a search result or a direct link can reach it.

  • Do not expose administrator functions through the Site application’s menus. Menu item types such as Site Configuration Options and Create Article are protected by permissions, but each additional front-end editing surface enlarges the attack surface.

  • Keep the hidden menu hidden. Pages in a menu without a module are not secret; they are only unlisted. Use access levels and noindex for anything that must not be found.

Version notes and book corrections

  • Menu types, the Menu Manager and the menu item form work the same way in Joomla 4.x, 5.x and 6.x.

  • The legacy J* class aliases removed from core in 6.0 (see Upgrading from Joomla 5 to 6) matter for menu-related code too: use \Joomla\CMS\Menu\AbstractMenu and Joomla\CMS\Router\Route instead of JMenu and JRoute in new code.

  • The tainted-URL redirect described in the routing section was added in Joomla 5.3 and is available in 6.x.

  • Joomla! 4 Masterclass (Marzo, Packt, 2023) is the best book overview of menus, but it targets Joomla 4, whose support ended in 2025-10. Its links to docs.joomla.org/J4.x and launch.joomla.org have moved: user documentation is now the Joomla User Guide at guide.joomla.org, and developer documentation is the Joomla Developer Manual at manual.joomla.org. Its keyword-centric metadata advice is outdated, as explained above.

  • Developing Extensions for Joomla! 5 (Cámara Mora, Packt, 2023) explains router views and menu item XML for components; those APIs still apply in 6.2, with the 6.0 removals noted above and a plugin and component code style that has moved on (event classes, defined('_JEXEC') or die; guards instead of JPATH_PLATFORM).

References