Authentication plugins decide how a person proves who they are when they sign in to the site or to the administrator.

The Joomla plugin checks the username and password held in the site's own user table, and is the one nearly every site relies on. A Cookie plugin handles the "remember me" option on the login form, and an LDAP plugin is included for organisations that authenticate against a directory server. Other methods can be added by installing third-party plugins.

Joomla also supports Multi-factor Authentication, set up per user account, asking for a second proof after the password. The methods included in Joomla cover authenticator apps, one-time codes sent by email, and hardware security keys. Separately, the Web Authentication plugin allows signing in with a passkey or security key instead of a password.

The plugins installed on this site, and the settings for each, are listed in the administrator under System → Plugins.