Joomla 6.1.4 and 5.4.9 are out with sixteen security fixes. We have checked every Multizone extension against them and released updates where our own code needed the same protection. Alongside that, a round of SEO work took this site’s Ahrefs health score from 84 to 100 — and the tools that did it are in MetaGen, which is free.
Joomla 6.1.4 and 5.4.9: what we checked
The release fixes sixteen security issues in Joomla itself, from cross-site scripting in HTML mail templates and toolbar links to access checks in the web services API, and adds 31 bug fixes. Most concern Joomla’s own components, but a few describe kinds of mistake any extension can make, so we went through our extensions for each one.
- Server-side requests (SSRF). Joomla hardened places where the server fetches an address someone else supplied. Four of our extensions do this, so all four now refuse any address on the server’s own network — local, private or cloud-metadata addresses — check every address a host name points to, and check each redirect along the way. The most important is Proposals, whose enquiry form lets a visitor enter a website address; update it first. Article Generator (sources, feeds and images), Content Amplifier (article images) and MetaGen (its site scan) have the same protection.
- HTML email. Our extensions that send HTML email already escape anything a customer typed, and none of them rely on the Joomla mail template feature that changed.
- Web services and toolbars. Our API endpoints make their own access checks, and our toolbar links look the same under the new escaping.
- Spreadsheet exports. One bug fix stops CSV exports running as spreadsheet formulas. Verified Forms’ exports already did this.
Update Joomla to 6.1.4 (or 5.4.9 on Joomla 5), then update your Multizone extensions from System → Update → Extensions.
MetaGen: from meta descriptions to a site audit
MetaGen started as a meta description generator. It now checks the things an audit tool such as Ahrefs reports on a Joomla site, and fixes most of them in one click. This round adds:
- A site scan. MetaGen fetches each published article as a visitor sees it and checks it has an H1, then checks every image and every link — to your own pages and to other sites. Broken images, broken internal links and outbound links returning a 4XX error are listed with the articles that use them. Run it from the Scan site button, or switch on the scheduled task to rescan every week in the background.
- A dashboard that says what to fix first. Four headline cards (open SEO issues, meta description coverage, articles improved this month, last scan), then Priority issues — your most-visited articles that have a problem — and Issues by category.
- A share image for every article. Articles without a picture of their own now carry a default share image, so links shared on social networks always have one and audits stop reporting incomplete Open Graph tags.
- Page titles measured the way search engines see them. Title too long now counts the site name Joomla adds to each page title.
- One host, not two. MetaGen warns if your site answers on both
www.and the bare domain instead of redirecting one to the other — a setting that quietly doubles every issue an audit finds.
Cassiopeia Themer: a share image in your brand
Themer’s Identity screen now builds a 1200 × 630 share image from your icon, your colours, your headings font and an optional tagline, previewed as you edit. Save Identity and MetaGen picks it up as its default share image. Themer’s own Open Graph and canonical tags have moved to MetaGen, so a site running both no longer publishes two competing sets.
Subscriptions Manager: a directory search engines can read
Every extension page in a Subscriptions Manager directory now has one address, used as its canonical and in its share preview, with old and alternative links redirecting to it. Pages publish proper Open Graph tags, screenshots carry captions used as their descriptions, and download links no longer send search engines round in a loop.
The result on this site
Before this work, Ahrefs scored multizone.co.uk at 84. Two days of updates later it scores 100, with no warnings. Along the way we redirected the bare domain to www., set a default share image, fixed the broken links and oversized images the scan found, gave long articles shorter browser page titles, and updated the extension directory. Every one of those steps is something MetaGen now finds for you.
Also in this round
- Payments: Stripe payments complete reliably on Joomla 6, a Repair with Stripe tool, accurate refund figures, and buyers joining your Updates email list.
- Subscriptions Manager: a Customers page with a contact log, ready-to-send win-back emails, and one period selector for the whole dashboard.
- Article Generator: the Pinboard works on Joomla 6.
Every change is listed in each extension’s changelog. As always, take a backup before updating.