This feature allows you to reset Joomla! Update to its factory default settings. This is meant to be your last resort to fixing issues with updating your site.

You should only use this feature if you get an error while checking for Joomla updates, the wrong update is displayed (e.g. an unstable alpha, beta, or Release Candidate version), or you seem to see no new updates despite knowing the Joomla! project has already published a new version AND you have exhausted any other options. Kindly note that the aforementioned issues are the only issues which can be addressed by this feature.

Please note that this will NOT magically fix all possible update issues. The following issues cannot be fixed:

Background: what is Joomla! Update, and why it might get stuck

Joomla! 2.5.2 and later versions come with a built-in component, Joomla! Update, which discovers updates to Joomla itself (colloquially called “core updates”), and lets you install them.

Discovering core updates is no different to discovering extension updates. In fact, the same mechanism is used for both kinds of updates. When you install Joomla, it installs a pseudo-extension called “Joomla CMS” and of the type File; you can see it in System, Manage, Extensions. This pseudo-extension has an update site called “Joomla! Core”; you can see it in System, Update, Update Sites. This update site always has an ID of 1 – this value is hard-coded into the Joomla! Update component.

Here we have the first possible set of problems. The aforementioned pseudo-extension may be missing, or disabled, thus preventing Joomla from even knowing it should check for core updates. The aforementioned update site may be missing, disabled, have the wrong ID (anything other than 1), point to the wrong URL, have the wrong type, or even be duplicated. All of these problems will prevent Joomla from detecting updates to itself. Moreover, the update site may have stored the wrong last checked timestamp with a value well into the future, meaning that Joomla will not be checking for updates until that point in the far future.

Joomla will check for core updates in the following circumstances:

The latest available version, and where to download it, is stored in the #__updates database table. Moreover, the Joomla update site record in the #__update_sites database table is updated with the current date and time put into its last checked timestamp.

This is where we can have another set of problems. The the #__updates database table may be broken, or otherwise the entry created by Joomla about its core updates may not be replaced when Joomla checks for core updates. This would prevent Joomla from “seeing” new versions. Moreover, the updates are cached for a period of time, by default 6 hours. This is defined in System, Update, Extensions, Options (NOT Joomla! Update itself!). While Joomla will only allow you to set up a value of 0 to 24 hours, it is possible that a direct database edit or third party software increases this time to several thousands of hours, essentially telling Joomla! to never check for core and extension updates.

Beyond that, Joomla! 5.1 and later use a more secure method for handling updates using the TUF (The Update Framework) protocol. While this is a very secure protocol, common real world issues such as a wrong file being cached in Joomla's update CDN, or your host erroneously returning a blank file with an HTTP 200 OK response through its transparent proxy instead of serving the correct file will result in Joomla! Update entering a state where it will either display a PHP error (exception), or otherwise be unable to “see” any future updates. Moreover, if you have not checked for updates in a very long time, if you restored a backup from a long time ago, or if you try to set up a very old Joomla! version (more than approximately a year old) the secure updates feature may decline to check for updates because the so-called “TUF root metadata” is past its expiration date. All of that can only be fixed by resetting the TUF metadata after the underlying issue has been addressed.

Addressing Joomla! Update issues manually

In most cases, addressing Joomla! Update issues with some manual intervention is possible.

First, make sure the Joomla core pseudo-extension exists and is enabled:

Then, we can make sure the Joomla update site exists and is valid:

Next up, we want to make sure that Joomla Update's configuration is correct, and the Joomla update site points to the correct URL.

We now need to make sure the updates caching is set up correctly:

Finally, we can check for updates again:

If you still do not see any updates and you know that a newer version of Joomla has been released, or if you see an update to an earlier or unstable (alpha, beta, Release Candidate) version you will have to use the Reset Joomla! Update feature to fix this issue; manual intervention is very complicated.

What Admin Tools' Reset Joomla! Update feature does

The Reset Joomla! Update feature tries to address all of the aforementioned issues by executing a series of actions:

Effectively, this resets Joomla! Update to stock configuration, and makes sure that secure updates (Joomla! 5.1.0 or later) will be able to see updates.

Security notes on resetting the TUF metadata

As noted above, one action taken by the Reset Joomla! Update feature is to reset the TUF metadata, replacing the root metadata with fresh information retrieved from Joomla's update servers. This effectively bypasses the security features offered by TUF (secure updates), but is necessary when the TUF metadata is missing, corrupt, or so out of date that it cannot be automatically updated.

Since the new root metadata is retrieved from Joomla's update server, this can cause a number of security concerns. None of them are likely, but you should be aware of them nonetheless.

If Joomla's update server is compromised, the attacker can replace the root metadata with a malicious copy which allows them to trick you into downloading and installing a malicious update, compromising your system.

If your host's server is compromised, an attacker may capture and modify the response of the Joomla update server in various ways such as directly changing the response data, resolving the Joomla update server to a malicious server under the attacker's control etc. This is, however, a very theoretical and rather improbable security concern. If someone has this kind of absolute control on your host's server, they can already hack your site directly instead of fooling you into maybe downloading a malicious update if their actions go undetected in the meantime.

If you are concerned about these possible attacks, there are many alternatives you can try if you suspect that your site is not being updated due to a TUF metadata problem.

First, you can install the update manually (it addresses updating your site, but not fixing the TUF metadata issue). Go to https://downloads.joomla.org/ and download the Upgrade Package for the Joomla! version you want to upgrade to in ZIP format. Then go to your site's System, Update, Joomla and click on Upload and Update. You can now use the ZIP file your downloaded to update Joomla.

As noted, this does not fix the cached TUF metadata issue which might be why you are not receiving updates. To fix that, you will have to edit the #__tuf_metadata record for Joomla in the database. You will need to remove the contents of the targets, snapshot, timestamp, and mirrors columns. You will also need to replace the contents of the root column. Which brings us to the next question. Where can you get this information from?

The safest place to get that information from is another site, which is known to be reliably locating updates for the same Joomla version as the stricken site. Copy that information from the known good site to the stricken site. Then go to System, Update, Joomla, and click on Check For Updates if necessary.

The other place you can find this information is Joomla's update server: https://update.joomla.org/cms/root.json. However, this is exactly where Admin Tools retrieves this information from. If you do not trust your host's server you can check the information Admin Tools retrieved with what you retrieve from two separate network connections (e.g. your regular wired Internet connection, and a mobile Internet connection – make sure to turn WiFi off on your mobile device!). If the information matches, you can trust your host's network and let the matter rest. If the information is different, fix it in your database and let your host know that they have a problem: they are either caching this information on their end for too long (most likely), or their server is compromised (least likely).