RFC: Maintenance Health Indicator for Joomla

[coolcat-creations]

The idea

My car recently reminded me that an oil change was due. I ignored the first service reminder for a while.

Then the warning changed to an exclamation mark and told me that continuing to ignore the service could potentially cause damage to the vehicle.

That got my attention. I immediately made an appointment with my local workshop.

It made me wonder: could Joomla do something similar for website maintenance?

Proposal

Joomla already tells administrators that updates are available. What is missing is an indication of urgency.

I propose a simple Maintenance Health Indicator in the Administrator Dashboard, with escalating states such as:

• 🟢 Healthy – no relevant maintenance required
• 🟡 Maintenance recommended – updates are available
• 🟠 Maintenance required – updates have been outstanding for an extended period
• 🔴 Critical – a critical security update is outstanding or an installed extension is known to be vulnerable

The escalation should consider more than just the age of an update. Where possible, Joomla could use vulnerability information, such as the Vulnerable Extension List, to identify known vulnerable installed versions.

For a critical vulnerability, the message could be very explicit:

Critical security update required.
An installed extension is affected by a known critical vulnerability. Please update immediately.

If reliable information indicates active exploitation, this could be reflected in the warning as well. Joomla should not claim that a website has been hacked without evidence.

Give users a way forward

The warning should always provide an appropriate action:

• View Updates
• Enable Joomla Core Automatic Updates
• View Security Information
• Find a Joomla Service Provider

Core automatic updates are already available, but they do not cover third-party extensions. The Maintenance Health Indicator would therefore still be useful even when Core updates are enabled.

Supporting the Joomla ecosystem

Not every website owner wants to maintain their own website.

When maintenance becomes significantly overdue, Joomla could point users to the official Joomla Service Provider Directory:

Don't have time to maintain your website? Find a Joomla professional.

This gives users a clear alternative while also creating more visibility and potential business for Joomla Service Providers.

The goal

The goal is not to create more warnings.

It is to make the existing information more meaningful:

"An update is available" → "Maintenance is overdue" → "This is a critical security issue."

Just like my car did, Joomla should make the consequences of continuing to ignore maintenance increasingly clear — and give the user a simple next step.

Happy to hear your Feedback about this Proposal

[brianteeman]

#47947

[HLeithner]

You should install every updated, no matter if it's declared as security update or not, main reason for this is that maybe bugs are fixed which haven't thought that it's a security issue.

[brianteeman]

plus some developers "hide" security issues inside "improvements" comments