I Asked Claude -- Is Joomla 3.x "Popular," or Just "Stuck"?

On this site I have written again and again about not taking AI answers at face value, and about checking primary sources with your own eyes. This time, keeping exactly that stance, I am leaving a record of deliberately asking an AI. The AI is Anthropic's Claude, which I use daily as a partner for log analysis.

Why write in this format? Because I thought there was more value in showing how the AI assembles its answer, and where fact ends and inference begins, than in the answer itself. AI is useful, but it speaks smoothly while mixing facts with its own reading of things. Checking that boundary together with the reader -- that is the point of this article.

My question

> People often say Joomla 3.x is still a popular version. Are these people using it because they genuinely like it, rather than being stuck because they cannot migrate?

A simple question. Support for 3.x ended long ago, yet it is still described as "popular." Is that affection, or circumstance?

Claude's answer (summarized and organized)

What was interesting is that Claude did not answer from memory. It began with, in effect, "my knowledge may be out of date, so let me verify first," and went to search. The answer that came back was built like this.

First, confirming the facts

• Official support for Joomla 3.x ended on August 17, 2023
• Extended security support (eLTS) patches ended completely in February 2025
• Today, no security updates of any kind exist for 3.x
• 3.x requires PHP 7.x, but hosting providers are retiring PHP 7 and pushing migration to PHP 8.x, so a server update outside your control can break your site

In other words, running 3.x today means operating in an environment where a discovered vulnerability will never, ever be fixed.

Then, the reading

Claude's answer was blunt: "Hardly anyone is choosing it because they genuinely like it." The reason: there is almost no rationality left in "continuing to use 3.x because you like it." So what is actually happening? The phenomenon that looks like a "popular version" is, Claude suggested, the sum of layers like these.

First, the layer that cannot move because of the technical hurdle of migration. This is likely the largest, it said. Moving from 3.x to 4.x is not a simple "upgrade" but a task called a "migration," and not every extension or template is compatible with 4 and later. The bigger the e-commerce extensions or custom components a site carries, the higher the wall. Not "I like it" but "I am afraid to break what is running, so I cannot touch it."

Second, the layer that does not correctly recognize EOL. The site still runs normally today, so no sense of crisis arises. End of support does not mean the site stops -- it just keeps running unprotected -- and that very fact becomes a breeding ground for the misunderstanding.

Third, the layer postponing on cost. A staged migration of 3.10.x to 4.4 to 5.4 to 6 requires testing at each stage and corresponding expense. The budget never materializes, and it slides on and on.

And the conclusion: the word "popular" is, in substance, more accurately re-read as "a large number remain because they cannot be moved."

The heaviest point, and it overlaps with this site's logs

Claude made one more observation that connects directly to what this site has observed. Attackers actively target known vulnerabilities in end-of-life software -- because they know the patches will never come.

This site recently published an article capturing, in its logs, attackers reading component manifests before the real attack -- scouting the version before they shoot. To that scout, how does a site identified as "Joomla 3.x" look? Not merely a vulnerable version of some individual plugin, but a permanently defenseless site in its entirety: a top-priority target. The claim from that article -- leaving an old version in place is tantamount to telling the attacker the hole is there -- applies to the major version of Joomla itself with even greater force.

Drawing the line between fact and inference so far

In keeping with the point of this article, let me make it explicit.

Facts (verifiable): the EOL dates, the end of eLTS, the hosting pressure to retire PHP 7, and the fact that migration is a migration-class task. These can be confirmed in public information. Note, however, that what Claude used for verification was mainly third-party Joomla-related sites. For the primary source on the dates, go to Joomla official (joomla.org and docs.joomla.org). I also confirmed them with my own eyes before publishing.

Inference (the AI's reading): the parts saying "hardly anyone genuinely likes it" and "most are the stuck layer." This is not the result of a statistical survey; it is a reading the AI reached by stacking up reasons. I found the chain of reasoning -- the wall, the lack of recognition, the cost -- persuasive, but there is no data showing proportions. Please check this part against your own sense of the sites around you.

What I took from it

Of Claude's answer, the reading that "hardly anyone genuinely likes it" and "most are the stuck layer" matched my expectations and I could accept it. But the three-part classification -- the wall of migration, the lack of recognition, the cost -- left me, frankly, unconvinced.

If my understanding is not mistaken, is the root of these people not something simpler? Are they not merely under the misapprehension that once a site is built, it can be used forever? The wall and the cost look like "unexpected burdens" precisely because they stand on top of that misapprehension. If you knew from the start that a website is not a monument finished at construction but a house that rots unless you keep tending it, migration would not be a "wall" but scheduled work.

And -- this is nothing more than my conjecture -- when the grave moment arrives, when the site is defaced and harm reaches its visitors, are not the majority the kind who push the responsibility onto someone else rather than themselves? The web agency is at fault, the hosting is at fault, Joomla is at fault. As if to convince themselves that what is happening now is a dream.

Here, let me also speak of myself. This site, too, has migrated from 2.x through 3, 4, and 5. It was plain to see that without migrating, site operation could not continue, so I discarded what could not be migrated and made up for it with what could, and pressed on. So that was never a story of "hardship." It was, throughout, scheduled work for the survival of the site's operation. And the accumulation was rewarded. The migration to Joomla 6.x was so easy I thought, "Wait -- is it allowed to be this easy?!" -- and that is how the present came to be. For those who keep maintaining, there is a reward: each next migration gets easier and easier. This I can say from experience.

So the conclusion of this article sits one step before the AI's reading. First, confirm your own site's version with your own eyes. Then, correct your recognition: to have a website is to keep maintaining it. That is all.

*The AI-answer portion of this article is a summary and reorganization of a dialogue with Anthropic's Claude, conducted in Japanese and translated here. The facts were checked against primary sources by the author before publication, but the parts presented as the AI's reading are not conclusions with statistical backing. When making decisions about your own site, always confirm the official information from Joomla.*