I do not wish to allow visitors to register on my website; however, I find a need to have a single registered user for testing purposes. For example, I will publish an article with restricted access so that my test user can see how the article looks on the site without "airing any dirty laundry" to the general public (ok, all 1/day who actually visit...).

My problem at the moment is that I do end up defacing the website since I have to publish/unpublish the user login form. Currently, I 'circumvent' this problem by hiding the login form in a subcategory so that it is not immediately visible to a casual visitor. Is it possible to create an alternative method (e.g. a custom URL) that will allow my test user to view content marked as restricted without altering what a guest with public access would see?


You can make a menu that isn't published, and put a link to the user login page there, and name the alias whatever you want. As long as you turn off the allow registrations function in the user manager options, you should be good.

Then just give your client the url.

So the steps are:

  1. Create a new menu, name it Hidden
  2. Don't publish a module of the new menu
  3. Add a new menu item, choose Users Manager and Login form
  4. Title the menu item Login or something so you know what it is, but change the alias to something someone wouldn't guess.
  5. Test your form by going to yoursite.com/aliasname

As an extension to Brian Peat's answer:

If you go to the url


you can login without having a menu item set or any kind of publish/unpublish problem. This could be termed as somewhat of a problem in Joomla as knowing your way around you can still register/login if you know the url structure. There are rules to prevent this but typically by default you can just use direct paths like that to get to where you need to go.


Here is it at work, even the main Joomla site which has no direct access to login can be accessed like that.

My point is, make sure you use proper ACL as well, if its "just" registered users then anyone who knows the structure of Joomla can get in. Also as Brian had said make sure allow registrations is off.

  • Is there an analogous URL for /index.php?option=com_users&view=logout (which I thought was intuitive but turns out to be incorrect)? – bobthechemist Jun 23 '14 at 14:21
  • You mean to auto log out? It is a bit strange, logout in joomla requires some post data, hence the form/button. That link will take you to a button basically. – Jordan Ramstad Jun 23 '14 at 14:23
  • If you're really worried about people getting into that page, you can either install a fancy plugin that forces the user to use a token as part of the url (I know there is one for the admin, pretty sure there's one for the front end)...but you can also install this: extensions.joomla.org/extensions/access-a-security/… which blocks IPs if the user tries say, 10 times to log in. It also notifies you. It'll open your eyes to how often your site is being attacked. I've noticed 100% of the tries all use "admin" as the username too. – Brian Peat Jun 23 '14 at 14:35
  • I just wanted to extend to say that, even without menu items, login/register is still accessible. So if there is a need to login without having to deal with a menu item it is possible, but it also means that anyone can do that. If register is not locked then anyone can also create an account and access any "secret" page there might be if there is no ACL to prevent it. This can be done by creating an extra ACL group, and making the user who can access it also in that group. The page in question would require that group as well. – Jordan Ramstad Jun 23 '14 at 14:51
  • Um, what good are ACLs if you're not already logged in. It is my understanding that you can't ever hide a public login page without a special plugin. Regardless, except for brute force attacks, if you don't have a login you can't get very far. I don't see the use in messing with this that much. – Brian Peat Jun 23 '14 at 16:38

You should be able to accomplish this by overriding the layout for the front-end login form. Add some PHP code near the top of the layout file. This added code checks for a custom parameter in the URL and for a particular value. If someone tries to access the login page through any URL but does not include the custom parameter and particular value (such as abc=xyz), then the code issues a "return;" so that the layout of the form will not be processed for display.

With this code in the overriding layout file, only a user who knows the URL (that includes this custom parameter and an acceptable value) will be able to use that login form.

For example: The secret URL can be


Then add this code near the top of the overriding layout file for the login form:

  • Nice idea! This is a pretty easy solution to disable the view. It can be extended to the module as well, if need be (though the module does not have a direct url to access). – Jordan Ramstad Jun 24 '14 at 21:51

I often faced a similar problem because I often want a front-end login in order to edit websites I manage, without the need to have a login form. I ended up creating a small bookmarklet that I added to my browser toolbar. This is obviously a very "local" solution, as the bookmarklet only is available to me (or anyone I copy the code to), but it works on ANY Joomla site and is an incredible time saver, simply click the link and the login form will be shown (given that you are on a Joomla site, of course...).

 javascript:void((function(){var loc = location.href; loc.indexOf("?") == -1 ? (location.href = loc+"?option=com_users&view=login") : (location.href = loc+"&option=com_users&view=login");})());

Your Answer

