Administrator Recovery for Joomla

Losing access to your Joomla administrator account can interrupt your work—especially when you cannot remember your password or username.

Administrator Recovery provides an email-based recovery process directly from the administrator login page. Eligible users can verify their email address and reset their password, or change their username when that option is enabled.

The extension works exclusively in the administrator area. It does not add recovery forms or buttons to the website frontend.

Joomla Compatibility

Administrator Recovery supports Joomla 4, Joomla 5, and Joomla 6.

Joomla 4 is the minimum supported version. Joomla 3 is not supported, and compatibility with future major versions has not been confirmed. Your server must also meet the PHP requirements of your Joomla version.

SAVE 30% Buy Now $19$13

Who Can Recover an Account?

This extension is intended for Super Users: accounts with Joomla’s global Super User permission.

It checks the account’s actual permissions rather than relying on a particular group name or group ID. Regular users and accounts with only standard Administrator permissions cannot use this recovery process.

To recover an account, the user must know its registered email address and have access to that inbox. Blocked accounts are not eligible.

Main Features

• Recovery directly from the administrator login page.
• Email verification before credentials can be changed.
• Password reset, with optional username changes.
• An IP whitelist supporting multiple addresses.
• Configurable verification-code length and expiration.
• Configurable request limits per email address and IP address.
• Separate English and Vietnamese language files.

Installation and Initial Setup

1. Sign in to your Joomla administrator area.
2. Open the extension installer and upload the Administrator Recovery installation ZIP.
3. Open Plugins and locate System - Administrator Recovery.
4. Review the plugin settings, then enable and save the plugin.
5. Open the administrator login page in a private browser window to check the recovery button.

Before testing recovery, confirm that Joomla can send email using the mail settings in Global Configuration → Server. The extension uses Joomla’s configured mail server and sender details.

Plugin Settings

Adding Multiple IP Addresses

Enter one IP address per line in the whitelist. IPv4, IPv6, and CIDR ranges are supported.

For example:

203.0.113.24
198.51.100.0/24
2001:db8:abcd::/48

Replace these example addresses with your actual trusted addresses.

The whitelist controls access to the recovery feature, including direct access to its URL. It does not restrict normal administrator login.

If your website uses a reverse proxy or CDN, ensure that the server reports the correct client IP. The extension uses REMOTE_ADDR and does not directly trust forwarded-IP headers.

How to Recover Your Account

1. Open the Administrator Login Page

Visit your website’s /administrator/ page and click the recovery button below the login form.

When username recovery is disabled, the button offers password recovery. When enabled, it offers username or password recovery.

2. Enter Your Email Address

Enter the email address registered to your Super User account, then click Send verification code.

The extension displays a general response to avoid revealing whether an email address belongs to an eligible administrator. This response alone does not confirm that an email was sent.

3. Enter the Verification Code

Check your inbox and spam folder, then enter the code in the same browser session used to request it.

By default, the code contains 8 digits and expires after 10 minutes. A maximum of 5 verification attempts is allowed.

4. Update Your Credentials

After successful verification, you have 5 minutes to complete the changes.

If Username recover is disabled, enter and confirm a new password.

If it is enabled, you can:

• Keep the existing username and change only the password.
• Change the username and leave both password fields empty.
• Change both the username and password.

The extension checks that the username is valid and not already in use. New passwords must match their confirmation and meet the extension’s requirements and Joomla’s native password rules.

5. Sign In Again

Return to the administrator login page and sign in using your updated credentials.

Recovery does not automatically log you in or disable multi-factor authentication. If MFA is enabled, you must still complete it during login.

Understanding Request Limits

Both the email and IP limits apply to recovery requests. A request must remain within both limits before an email can be sent.

Changing a limit does not clear the current counter. For example, if an email address has already used 3 requests, increasing its limit to 10 allows up to 7 additional requests during the current hourly window, provided the IP limit also permits them.

Changes to code length and expiration apply to newly issued codes. Codes already sent retain their original settings.

If the Verification Email Does Not Arrive

Check the following:

1. Joomla’s mail server settings are correct and a Joomla test email can be sent.
2. The address belongs to an active Super User account.
3. The message has not been placed in the spam folder.
4. The email or IP request limit has not been reached.

For technical failures, check the extension’s adminrecovery.php log file in Joomla’s configured log directory.

Administrator Recovery is designed for credentials managed locally by Joomla. Recovery of external LDAP/SSO credentials or lost MFA methods is outside its scope.