Handing Over a Joomla Site to a Client

A Joomla project doesn't end at launch. It ends when the client can own the site: publish content safely, understand what they're paying for, and know who to call when something goes wrong. Most "broken" client sites were never broken by code. They were broken by a handover that gave a nervous editor Super User access and a login URL, and nothing else.

This guide walks through a professional handover in ten steps. Almost everything uses Joomla's core features, so it works on any Joomla 5 or 6 site without extra extensions.

A good handover achieves three things:

• The client can do their job. Editors see only what they need, and daily tasks take a few clicks.
• The site stays safe. Mistakes can be undone, permissions stop accidents, and accounts are protected.
• Everyone knows the boundaries. Ownership, responsibilities and support terms are written down, not assumed.

1. Make the Site Production-Ready

Before anyone else logs in, switch the site from "development" to "production." Most of these settings are in System → Global Configuration.

Then clean up what the build left behind:

• Delete test content and test users, including sample articles, dummy categories and "test@" accounts.
• Uninstall extensions you tried but didn't use. Disabled isn't enough, because disabled code is still code an attacker can reach.
• Remove leftover files such as phpinfo.php, old backups and database dumps in the web root.
• Check the details clients notice: favicon, site name, 404 page, contact form delivery and the cookie consent banner.
• Run a final update check in System → Update → Extensions, so the client starts on current versions.

2. Settle Ownership Before You Hand Over the Keys

The client should own everything the site depends on. If you disappear tomorrow, they must still be able to run it. This protects them, and it protects you from being the single point of failure for someone else's business.

Who gets Super User?

The client owns the site, so they should have a Super User account. But nobody should use it for daily work.

A practical setup looks like this:

• The client's emergency Super User account, with its credentials stored in the client's password manager and never used day to day.
• Your own Super User account, for maintenance, under your name so the action log shows who did what.
• Everyday accounts for staff, in a restricted group (Step 3).

Never share one login between several people. Named accounts make the action log meaningful, and you can remove one person's access without resetting everyone else's.

Send credentials through a password manager's sharing feature or a one-time secret link, never in plain email.

3. Create a Client User Group with the Right Permissions

Joomla's Access Control List (ACL) is one of its biggest advantages over other CMSs, and handover is where it pays off. Instead of giving editors the built-in Manager or Administrator groups, create a group that matches the client's real job.

Create the group

1. Go to Users → Groups → New.
2. Name it after the role, e.g. Client Editor.
3. Set Group Parent to Registered. Starting from a low-privilege parent means the group inherits nothing dangerous.

Give it admin access, and nothing more

In System → Global Configuration → Permissions, select Client Editor and allow only:

• Site Login and Administrator Login
• Create, Edit, Edit State and Edit Own

Leave everything else as Not Set (which means denied). That includes Configure, Access Administration Interface for components, Delete and Super User.

Open only the components they need

Now open each component the client uses, such as Articles, Media or Contacts. Click Options → Permissions and allow Access Administration Interface for Client Editor.

Every other component stays invisible to them: templates, extensions, users, global configuration, and your custom component's settings.

Useful patterns

Test every role. Log in as a test user in each group, preferably in a private browser window, and try to do their daily tasks. Then try to reach things they shouldn't, like Templates or Global Configuration. Delete the test users afterwards.

4. Simplify the Administrator

Permissions stop clients from breaking things. A simpler interface stops them from feeling lost. Joomla lets you reshape the admin without writing any code.

A custom administrator menu

The default sidebar lists every Joomla feature. Replace it with a menu that matches the client's vocabulary:

1. Go to Menus → Manage, switch the filter from Site to Administrator, and click New. Name it, for example, Client Menu.
2. Add only the items they use, with plain names: News (a filtered Articles list), Events, Images (Media) and Contact messages.
3. Go to Content → Administrator Modules, open the Administrator Menu module, and set it to use Client Menu.
4. Assign that module to an access level containing only the client groups. Keep a second Administrator Menu module with the full menu for Super Users.

Menu items can link straight to a filtered view, such as the articles in the "News" category. The client clicks News and sees only news, never the whole content tree.

A dashboard with shortcuts

On the Home Dashboard, add a Quick Icons module with shortcuts to the client's three or four most frequent tasks, such as "Add a news article" or "Upload images." Unpublish dashboard modules that mean nothing to them, like system information or the extension update feed.

Brand the admin

In System → Administrator Templates Styles → Atum, you can set:

• The client's logo in the header, in large and small versions
• A colour hue that matches their brand
• A dedicated logo for the login page

It's a small touch, but it makes the admin feel like their system rather than a technical tool.

5. Make Content Editing Safe

Clients will make mistakes. The goal isn't to prevent every mistake, but to make each one small and easy to undo.

Turn on versions

In Content → Articles → Options → Editing Layout, set Enable Versions to Yes and choose how many versions to keep (10 to 20 is plenty). The client can then open Versions on any article, compare revisions and restore an older one.

This single setting prevents more support calls than any other. "I deleted half the page" becomes a two-click fix.

Give editors a simpler editor

The TinyMCE plugin (System → Plugins → Editor - TinyMCE) has three toolbar sets, and each one can be assigned to user groups:

• Client Editor gets a clean toolbar: headings, bold, italic, lists, links, images and tables.
• Super Users keep the full toolbar, including source code.

Remove font colours, font sizes and font families from the client set. They're the main way a carefully designed site ends up with purple Comic Sans. Also remove direct HTML editing unless the client is technical.

Keep the design in the template

Give clients structure instead of styling. A few ways to do this:

• Custom Fields for structured data, such as event dates or a staff member's role, which the layout then formats consistently.
• Predefined styles in TinyMCE for things like an info box or a highlighted quote, mapped to your CSS classes.
• A starter article with the right heading structure, which the client duplicates using Save as Copy.

Protect the media folder

In Content → Media → Options, set the allowed file extensions and a maximum upload size. Explain image sizes in the handover document. A 12 MB phone photo on the homepage is the most common way a client slows down their own site.

Consider frontend editing

For very non-technical clients, editing directly on the website can be easier than the admin. Joomla supports frontend editing of articles and modules with the same permissions. Core layouts already show an Edit icon to logged-in users who have permission, so all they need is a login menu item they can bookmark.

6. Secure the Client Accounts

A client's stolen password is one of the most common ways a well-built site gets compromised. Joomla has strong protection built in, so switch it on before handover.

Enforce multi-factor authentication

In Users → Manage → Options → Multi-factor Authentication, add every group with admin access to Enforce MFA for these user groups. Those users must then set up a second factor on their next login.

Joomla supports several methods. The friendliest for clients are:

• Passkeys (WebAuthn): Face ID, fingerprint or a security key, with nothing to type.
• Authenticator app codes: Google Authenticator, Microsoft Authenticator or a password manager.

Always have the client save their backup codes in their password manager. Walk through this with them during training, because lost phones are the classic weekend emergency.

Set a password policy

In Users → Manage → Options → Password Options, set a minimum length of at least 12 characters. Length matters more than symbol rules, and encouraging a password manager matters most of all.

Keep an audit trail

Make sure the User Actions Log plugins are enabled. Users → User Actions Log then shows who logged in, and who created, edited or deleted what, and when.

When a client says "the page just changed by itself," the log usually tells you in seconds which account did it. That turns an argument into a quick, friendly fix.

Lock down the rest

• Don't use admin as a username. It's the first one attackers try.
• Remove forgotten accounts. Check Users → Manage for old test accounts and former staff.
• Consider protecting /administrator with a hosting-level password or an IP allowlist, if the client works from fixed locations.

7. Train the Client with Guided Tours

A one-hour training call is forgotten within a week. Training that lives inside the admin is there whenever the client needs it.

Write your own Guided Tours

Joomla's Guided Tours (System → Guided Tours) show step-by-step pop-ups that highlight buttons and fields on the real screen. Joomla ships tours for its own features, and you can write tours for the client's specific tasks:

• "How to publish a news article"
• "How to add an event with a date and a photo"
• "How to replace the homepage banner"

Each step targets an element on the page and explains it in one or two sentences. Assign each tour to the client's user group so they see only tours that apply to them. The tours are available from the Guided Tours icon in the admin header at any time.

Keep the training session practical

Run the session on the live site, with the client driving, not you. Cover:

1. Logging in with MFA, and where the backup codes are stored.
2. Their three or four daily tasks, done by them, start to finish.
3. Restoring an article from Versions, so they know mistakes are recoverable.
4. What not to touch, and who to call.

Record the session. A 20-minute recording is often the most-watched "documentation" a client will ever have.

8. Write the Handover Document

The handover document is the site's manual and its birth certificate. Keep it short, in plain language, and in the client's language. Store it somewhere they control, never only in your own files.

A good handover document covers the following:

Add a short "If something goes wrong" page: who to call, what information to send (the page URL, a screenshot, what they did just before), and what not to do, such as reinstalling extensions or restoring old backups themselves.

You can publish the how-to parts as a private, admin-only area or a PDF. Many developers keep the document itself in a shared doc the client owns, so it can be updated after every change.

9. Plan for Life After Handover

A Joomla site needs regular care, like any software. Agree before launch who is responsible for it. "We assumed you were doing the updates" is how sites end up three versions behind and hacked.

Offer a care plan

A care plan turns open-ended support into a clear service, and gives you recurring income. A typical plan includes:

• Core and extension updates, tested on a staging copy first for major versions
• Automated off-site backups, plus a restore test every few months
• Security and uptime monitoring
• A monthly report: what was updated, backup status, and any issues found
• A small number of support hours for content help or minor changes

If the client declines a care plan, put that decision in writing. Make it clear that updates and backups are then their responsibility.

Automate what Joomla can do itself

The Scheduled Tasks feature (System → Scheduled Tasks) runs maintenance jobs without cron scripts. Useful tasks include update notifications emailed to the Super Users, and regular clean-up of old action log entries.

Back up properly

Joomla core doesn't include full-site backups. Use your host's backups plus a dedicated backup extension that stores copies off-site. Follow the 3-2-1 rule: three copies, on two kinds of storage, with one off-site. A backup nobody has ever restored is only a hope, so test a restore at least twice a year.

Schedule a check-in

Book a short call two to four weeks after launch. By then the client has real questions, and small annoyances can be fixed before they become frustrations. It's also the natural moment to agree on a care plan if you haven't yet.

10. The Handover Checklist

Use this list on every project. Copy it into your own project template and tick it off before you send the final invoice.

Production

• Debug and language debug off, error reporting set to None
• SEF URLs on, HTTPS forced, robots set to index, follow
• Caching enabled and tested
• SMTP configured and a test email received
• Test content, test users and unused extensions removed
• Leftover files (backups, dumps, phpinfo.php) deleted from the web root
• Core and extensions fully updated

Ownership

• Domain, hosting, DNS and email registered to the client
• Paid extension licences in the client's name
• Search Console and Analytics owned by the client
• Client's emergency Super User created and stored in their password manager

Access and admin

• Client user groups created, with minimum permissions
• Every role tested with a test account, then test accounts deleted
• Custom administrator menu and quick icons in place
• Atum branded with the client's logo and colour

Content safety

• Versions enabled for articles
• Simplified TinyMCE set assigned to client groups
• Media file types and upload size limited

Security

• MFA enforced for all admin groups, backup codes saved
• Password policy set
• User Actions Log enabled

Training and documents

• Custom Guided Tours for the client's main tasks
• Training session held and recorded
• Handover document delivered and stored where the client controls it

After launch

• Care plan agreed, or the client's responsibility confirmed in writing
• Off-site backups running, and one restore tested
• Update notifications scheduled
• Check-in call booked for two to four weeks after launch

A good handover is mostly configuration you already know how to do, applied with the client's day-to-day life in mind. Joomla's core does the heavy lifting: ACL for safe roles, a custom admin menu for clarity, Versions for undo, MFA for security, and Guided Tours for training that never gets lost.

The result is a client who feels in control of their site, fewer panicked calls, and a relationship that naturally continues into a care plan. For a Joomla developer, that is the difference between delivering a website and delivering a working business tool.