Joomla Multisite Management: all sites in one dashboard
Joomla Multisite Management starts off innocently enough: three client sites, everything under control. At twelve it gets unwieldy, at thirty you start guessing. And when a vulnerability like the one in JCE or SP Page Builder becomes public, the first question is not "how do I patch this" but "on which of my sites is this thing even running?" A central dashboard answers exactly that in seconds. This article shows how that works with the HTProtect.app Control Dashboard - without handing over master keys to all your sites.
Updated: 25. Juli 2026
Contents
First, let's sort out the terms: Multisite is not multi-site management
Anyone searching for "Joomla Multisite" gets two completely different things thrown into one pile. That is why so many searches end up going nowhere.
- Multisite in the stricter sense: one Joomla installation that serves multiple frontends. One file tree, one database, multiple domains. There are extensions for this such as JMS Multi Site or MightySites. Joomla cannot do this natively, but WordPress and TYPO3 can.
- Multi-site management - that is what this is about: many independent Joomla installations, each with its own hosting and its own database, and one dashboard from which you can see and manage them all.
The difference is not academic. Option one saves storage space but creates a major single point of failure: one vulnerability, all sites gone. Option two keeps the sites cleanly separated and solves the exact problem agencies and freelancers actually have - keeping track of everything. Anyone managing client sites almost always wants the second option.
Why even ten Joomla sites are too many for manual work
Do the math. A proper review of one site - logging in, checking updates, verifying backups, taking a quick look at the log - realistically takes ten to fifteen minutes. For twenty sites, that is four to five hours. Every week. That is why most people do it not weekly, but "when there is time". That is exactly where the gap appears.
The real problem is not the effort, but the time between a vulnerability becoming known and the patch on your site. In the attack waves of recent months - JCE, Helix3, Helix Ultimate, SP Page Builder - there were often only hours between the public warning and the first large-scale scans. Anyone who only starts clicking through twenty backends on the weekend is too late. In those weeks, we cleaned up site after site whose operators knew about the vulnerability - they just did not know which of their sites was affected.
A dashboard solves exactly that. It answers "who is affected?" in seconds instead of hours.
The problem with classic multi-site managers: the master key
Almost all central management services work in the same way: you install a connector on each site, and the service stores credentials or a token that lets it do everything on that site. Convenient - and a design flaw that rarely gets discussed.
Because that puts a master key for your entire fleet on a single server. If that server is compromised, not one site is gone, but all of them. This is not a theoretical scenario: supply-chain attacks - hijacked update channels, compromised extensions, compromised service providers - have been among the most effective methods for years, because one hit can reach hundreds of targets.
There is often a second problem as well: many services require an externally reachable endpoint on your site. By definition, that is additional attack surface - one more door someone can force open.
HTProtect.app: central control, but without a master key
HTProtect.app is the control dashboard for the free Joomla security component HTProtect. Any site running HTProtect can be connected voluntarily and then appears in a shared overview. What matters is less that it exists, and more how it is built.
Your browser signs, not the server
When pairing, a key pair is created. The public part is stored permanently on your website, while the private part stays in your browser. Every command you trigger in the dashboard is signed in your browser with an Ed25519 signature. The website verifies this signature before doing anything - and only executes what matches.
The dashboard server holds no signing key. It is a messenger, not a commander. Even if someone completely takes it over, it cannot generate a valid command. And if your server is missing the required crypto library, nothing is executed at all - the logic fails closed, not open.
Outbound-only: no open port
Your sites connect outbound to the dashboard - normally a heartbeat every 30 minutes, plus regular checks for waiting commands. There is no endpoint that anyone from the outside can knock on. That is why this also works behind firewalls, behind a CDN, and with hosts that block special incoming paths.
Side effect for those who hesitate: as long as a site is not paired, the connector is completely inactive. No heartbeat, no connection, nothing at all. Anyone using HTProtect only locally will never notice the dashboard.
The command list is short - and that is the real point
The most honest thing about the design is what does not work. The website knows a fixed, deliberately limited list of allowed remote commands. Anything outside that simply does not exist for it - even with a valid signature. In essence, the following are allowed:
- Refresh status
- Install updates and set update rules
- Start malware scan and schedule it
- Check core files against the original
- Reapply the shield (self-healing)
- Mark a reported account change as known
- Analyze, create, schedule, download, delete, restore backups
What cannot be remotely controlled, by design: turn off the shield, change backend password protection, write or edit files, uninstall HTProtect, and automatically delete malware findings. These are exactly the actions an attacker would try first. They can only be done locally, in the Joomla backend of the respective site.
This design choice sacrifices convenience and adds security. You just need to know it, otherwise you will look for the "shield off" button in the dashboard in vain.
What you see and control in the dashboard
Traffic-light overview across the entire fleet
Each site is one row: green, yellow, or red. Plus Joomla version, pending updates, last scan, detected issues, last heartbeat. In seconds you can see where there is a problem instead of clicking through twenty backends. Sorting and filtering are available, as are tags for customer groups or hosts.
Vuln radar across all sites
This is the most valuable function. HTProtect continuously compares the installed extensions against a list of known security vulnerabilities, via a signed live feed that is updated every few hours. In the dashboard, this becomes a fleet view: "Three sites are running a vulnerable com_xyz." One click, update all affected sites.
That is exactly the answer to the question from the beginning. When the next vulnerability appears tomorrow, you do not have to guess.
Auto-updates: rules per extension, for all sites at once
You centrally control the automatic extension updates: interval, time, grace period. Security updates run without delay, everything else follows your schedule. Before every update, a backup is created; afterward, a health check and malware scan run - and if anything goes wrong, the site rolls back automatically.
Recently, the "auto-update" setting for each extension can be set in both places, in the dashboard and directly in the Joomla backend, and both stay permanently in sync. Extensions with a known, open vulnerability are always updated; your manual opt-out stays saved and takes effect again as soon as the vulnerability is closed.
Remote malware scans
One click starts the HTProtect malware scanner on a site - or you schedule it: every three days, weekly, monthly. A typical scan takes 30 to 60 seconds; on very large sites it continues in resumable chunks without running into a timeout. Progress is visible in the dashboard, and if something is found, an email is sent immediately.
Core integrity in seconds
The Joomla core file check compares your installation with the original and reports any deviation, typically within five to ten seconds. Injected code in core or template files is detected this way, even if it does not match any known signature.
Shield self-healing
If HTProtect improves its .htaccess rule set, the shield is automatically re-applied - including a self-test on the live server and automatic rollback if a rule does not fit. You can still trigger it remotely. For anyone managing many sites, this saves the "secure now" step on each individual one.
Defacement and rogue admin detection
The guardian on each site reports when a new Super User appears, a password is changed silently, or the homepage suddenly looks different. In the dashboard, this appears as a plain-text event. An account change you made yourself can be marked as known remotely - but malware findings and rogue admin patterns are intentionally not. You want to review those.
Outage detection from outside
The dashboard does not rely only on the reports from your sites, but also checks from the outside every 30 minutes. If more than two heartbeats are missed, the site is marked as a problem. It sounds simple, but it is not: A site that is completely down cannot, by definition, report in itself.
Backups with scheduling - and restoration
Since HTProtect 2.5, there are separate full and incremental backups on a schedule, incremental and space-saving. You plan and start them from the dashboard, see the storage usage broken down, and before restoring, the current state is backed up once more. The download is signed and runs directly from your website to your browser - the dashboard server never sees the content. If you prefer to stay with Akeeba: we have described restoring with Kickstart separately.
One click into the backend - despite password protection
HTProtect can protect your /administrator with an additional password. That is exactly what otherwise becomes annoying in centralized management. From the dashboard, you can still get into the Joomla backend with one click, without entering anything and without even briefly relaxing the protection. Technically, this is not a queue command, but a directly signed process that is permanently bound to the target host.
Team, log and mobile
Sign-in works via passkey. You add colleagues by invitation, with permissions per person. Every action is recorded in an activity log. The interface is consistently built for small screens and can be installed like an app via "Add to Home Screen", completely without a store. For quick checks in between, this is the part you use most often.
Pairing in three steps
- Install HTProtect - if you have not done so yet, upload the free component to the Joomla backend and click "Secure now" once.
- In the dashboard, click "Add website" - you will receive a code.
- Enter the code in the Joomla backend - done. No password, no port, no login data stored anywhere.
The first site is connected in under a minute, and each additional one is faster. If pairing fails with a "406 error", this is due to a protection module at the hosting provider. This was a known issue and has been fixed since version 2.5.1 - updating the component is enough.
What the server never gets to see
Here, accuracy matters more than marketing hype. The dashboard server receives status data: versions, pending updates, traffic-light status, and the progress of a running process (type, phase, percentage). What it does not receive: the paths and names of malware findings, the deviations from the integrity check, and the contents of your backups.
HTProtect itself openly names one exception: the permanent backup exclusion list - that is, which directories and tables you leave out - is sent in plain text to the server, because otherwise the dashboard could not display it. This is a deliberate trade-off, not a vulnerability. But it should be stated.
Classification: the alternatives
HTProtect.app is not the only tool in this field, and depending on how you work, something else may be a better fit. In short and fair terms:
- Akeeba Panopticon - free and self-hosted. If the data absolutely has to stay on your own server, this is the obvious choice. The trade-off: you also run and maintain an installation, including cronjobs.
- YourSites - takes a different approach: you install the extension on a separate Joomla site, and it manages all the others from there - including WordPress and ClassicPress. It can run in an intranet, behind a firewall, or locally on your computer, so customer data stays entirely with you. It can install and uninstall extensions across the fleet. In return, you are responsible for operating and securing the management instance yourself.
- mySites.guru - very mature, for Joomla and WordPress, with white-label customer reports. Anyone managing both systems and sending reports to clients will find the broadest feature set there.
- Watchful - well established for a long time, also for Joomla and WordPress, with centralized license management for commercial extensions.
- BackupMonkey - German team, infrastructure in Germany, GDPR compliance as an explicit selling point, Joomla and WordPress. The connector is deliberately kept simple and is not allowed to take over the website at all - no changing user data, no installing, no running code. That is the same basic idea as here, just implemented differently. Its strength is backups: backups run via Akeeba Backup and are then restored as a test, because an untested backup is no backup. In addition, there are white-label customer reports.
- ManageWP, MainWP, InfiniteWP - strong, but WordPress only. Not relevant for Joomla.
The difference with HTProtect.app lies less in the feature set than in the approach: the security functions come from the same engine that already runs on every site anyway, and the central server deliberately stores no keys. What HTProtect.app currently cannot do: white-label customer reports. If you send your clients a branded monthly maintenance report, you will still need something else for that.
What it costs
Pricing is tiered by number of websites, not by features - every plan includes every feature, including the free one. Up to five websites, it is permanently free; beyond that, it starts at a single-digit monthly amount and scales up to 150 websites. From the first paid plan onward, a fixed number of emergency cleanups per year is included: if one of your sites gets hacked despite HTProtect, we take care of the cleanup. Current figures are listed on the pricing page.
Who it is worth it for - and who it is not
Worth it if you manage more than a handful of Joomla sites, if you want to know within seconds who is affected during the next wave of attacks, or if you maintain sites for clients and need traceability.
It is rather not worth it if you have exactly one Joomla site. In that case, HTProtect already gives you everything you need locally, and the connection only adds convenience. And if, for organizational reasons, your sites are not allowed to make outbound connections, the model will not work - then a self-hosted solution is the more honest answer.
Frequently asked questions
What is the difference between Joomla Multisite and Joomla Multi-Site Management?
Multisite refers to a single Joomla installation that serves multiple frontends - this requires extensions like JMS Multi Site, because Joomla cannot do this natively. Multi-Site Management means many independent Joomla installations that you monitor and control through a shared dashboard. For managed client websites, this almost always means the latter.
Can I update multiple Joomla sites at the same time?
Yes. In the HTProtect.app dashboard, you set update rules per extension or for all websites at once and apply pending updates with a click. Before each update, a backup is created, then a health check and malware scan run; if a problem occurs, the site rolls back automatically.
Is the dashboard free?
Yes, for up to five websites permanently, with full functionality. Beyond that, pricing is tiered by number of websites, not by features. The HTProtect component itself is completely free regardless.
Do I have to trust the dashboard operator?
Less than with most comparable services. The server does not hold a signing key or any site password; every command is signed in your browser and verified by the website. A fully compromised dashboard server cannot take over a single site. And the list of what can be remotely controlled is intentionally kept short.
Does my website need an open port or endpoint for that?
No. The connection runs exclusively outbound from your site to the dashboard. There is nothing that needs to be reachable from the outside. This also works behind firewalls and CDNs.
Which Joomla versions are supported?
HTProtect runs from Joomla 2.5 to 6 and on PHP 7.4 to 8.5. This means that even old installations that have long since stopped being maintained - which are statistically the most frequently hacked - can also be integrated.
What happens if a site is no longer reachable at all?
Then external monitoring kicks in. The dashboard also checks from the outside every 30 minutes; if more than two heartbeats are missed, the site is shown as a problem - exactly when it can no longer report in itself.
Can I turn off the shield remotely?
No, and that is intentional. Turning off the shield, changing backend password protection, editing files, uninstalling, and automatically deleting malware are deliberately excluded from remote access. These actions can only be done locally in the Joomla backend of the respective site.
What is the best alternative to mysites.guru or Watchful for Joomla?
That depends on what you need. For white-label client reports and mixed Joomla/WordPress fleets, mySites.guru and Watchful are still stronger. For purely self-hosted setups, Akeeba Panopticon is the obvious choice. If security architecture and Joomla-specific detection matter more to you than reporting, HTProtect.app is worth a look - especially since getting started costs nothing.
And what if a site still gets hacked?
Then every paid plan includes a fixed number of emergency cleanups per year. Otherwise, the usual applies: We clean hacked Joomla sites professionally, find the entry point, and make sure it does not happen again right away.
Questions or something unclear? Feel free to write it in the comments below the article.
- Details
- Last Updated: 25 July 2026
