My client realizes that we can access to components in Joomla by using non-SEF URL even when SEF is enabled.

He doesn't like it, because with no Itemid in the URL, the page is messy. For example, http://www.joomla.org/index.php?option=com_content is what he doesn't want people to see on his site.

Is there any way we can block access to the site by using non-SEF URLs when SEF is enabled in Global Configuration?

3 Answers 3


You can create a system plugin with this code:

public function onAfterInitialise(){
    $app = JFactory::getApplication();
    $config = JFactory::getConfig();
    $uri = JUri::getInstance();
    if($config->get("sef") && $app->isSite() && $uri->getQuery()){
        throw new Exception("Not Found", 404);

So, if we have anything after question mark ?, it throw a 404 error.

Instead throw a 404 error you can redirect the user to the home page if you want.


If you want to allow that some extension uses question mark, you can do:

public function onAfterRoute(){
    $app = JFactory::getApplication();
    $config = JFactory::getConfig();
    $menu = $app->getMenu();
    if($config->get("sef") && $app->isSite() && !$menu->getActive()){
        throw new Exception("Not Found", 404);

If the current route doesn't have a associated menu, it throw a 404 error.

  • It is a nice solution. However we need to make sure there is no extensions using question mark to define layout or doing its own functions. Eg, domain.com/submit?layout=success, domain.com/submit?layout=error
    – Hung Tran
    Commented Apr 27, 2014 at 2:29
  • 1
    @HungTran See my edit above
    – csbenjamin
    Commented Apr 27, 2014 at 6:00
  • Thank you, I tried and it worked perfectly. Wonder why I hadn't thought about using system plugin before.
    – Hung Tran
    Commented Apr 29, 2014 at 4:02

But how casual visitors will ever guess the non-SEF URLs and use these instead of the SEF one, so they can get the messy template view ?

Anyhow, one way to avoid this is to use a 3rd party SEF extension, that will alway translate a non-SEF to corresponding SEF url. Visitors won't see the non-sef in the browser's address bar.

But the problem with the messy template will not disappear. I guess this issue is due to the fact that a different menu item or no menu item at all is considered, while viewing the pages, so any css suffixes, modules or other special things intended for these pages will be handled correctly.

To eliminate this issue, you need to assign these pages to the desired menu item.

  • 2
    The problem is, there are lots of bad bots out there who will scan your site for anything and everything, so hiding it from the front end user doesn't really mean much. I've seen access logs filled with component urls for things I don't have installed because they were scanning for vulnerable components.
    – Brian Peat
    Commented Apr 26, 2014 at 16:26
  • That is true, but Hung referred to the human visitors and how to prevent displaying non-sef urls without the correct menu-item that causes display issues.
    – FFrewin
    Commented Apr 26, 2014 at 16:59
  • Old bookmarks or Google results are ways to get to the undesired urls. Also avoiding the mess and prohibit usage are two different things. Obviously, you can't stop them entering the undesired urls. You can stop Joomla responding to them.
    – sovainfo
    Commented Apr 27, 2014 at 10:26
  • Okay, also agreed on that. But why to serve a 404 page, when that page actually exists and you can beautifully make it show with the desired url ? Also eventually, especially google will eliminate any non-sef url from the search results, when there will be a canonical sef one. And I feel what Hung asked is that they don't like the non-sef to be visible and to avoid any display issues when no item-id or the wrong one exists.
    – FFrewin
    Commented Apr 28, 2014 at 10:24

My recommendation would be to use sh404sef and always pin an itemid to URLs without one. See "Item Id Management" as a part of it's configuration:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.