Protected extensions

Protected extensions

All extensions in Joomla! have a record in #__extensions.

One of the man fields on that table is protected.

Back in the day

Originally, the protected field was meant to designate core Joomla! extensions. When the field was 1 the extension was core Joomla! and not to be touched; the extensions manager would refuse to uninstall, update, enable, or disable it. When the field was 0 it was a third party extension and you could do whatever you please (other protections notwithstanding).

How it works now

Since Joomla! 3.10 the semantics of the protected extension have changed somewhat.

A Protected (protected = 1) extension cannot be uninstalled or updated.

An Unprotected (protected = 1) extension can be uninstalled or updated.

Joomla determines if an extension is core or not by comparing the extension's defining properties (the values of the type, element, folder, and client_id fields) against a hardcoded array in its code. If you are a developer, look at the \Joomla\CMS\Extension\ExtensionHelper::checkIfCoreExtension() method for further details.

That said, only core Joomla! extensions should be Protected. Third party extensions do need to be uninstalled and updated, therefore they must have protected = 0.

Obsolete core extensions are now a thing…

The situation is complicated somewhat by the fact that Joomla! occasionaly drops some core extensions.

For example, Joomla! no longer provide a CAPTCHA extension. For example, if you had upgraded from Joomla! 4 to 5 your Joomla! 5 site would still have the “CAPTCHA - Invisible reCAPTCHA” plugin installed. This is no longer a core extension, but it's still protected. That is to say, if you used Joomla as it was designed to be used you have ended up with an extension which cannot be uninstalled, or updated, but it's no longer maintained by Joomla!, therefore ending up with a potential security or functional issue in your site. That's bonkers, right?

Luckily, you CAN uninstall these obsolete core extensions with Onthos.