When I started SoftForge, I was maintaining my own content management system. I say "system"; it was a poorly crafted piece of coding that I was nursing along single-handedly, and it existed to satisfy one deceptively simple request from a client. They wanted to be able to wake up at four in the morning, log in, and post their own article. That was it. That was the whole brief, and it very nearly broke me.

After months of trying to maintain my own CMS, months that felt like years, I went looking for something better. I came across Mambo, an award-winning CMS at the time, and I looked at WordPress and Drupal too, but Mambo was the one I preferred. And then, almost overnight, Mambo had a competitor: Joomla.

So I took a proper look. What I heard from the people coding Joomla was an eagerness to move with the times, to build a clean MVC system, to do it properly. They were, to my mind, developer first, and that reassured me. It meant the skills I had picked up building my own creaky CMS would carry across rather than count for nothing. I read the code, and I was pleasantly surprised at how often the Joomla developers had spotted and solved the very problems I had been wrestling with alone.

That was the lightbulb moment. Why on earth was I maintaining an entire codebase when there was a whole team of specialists doing the same job, better, and giving it away? Why not just use their codebase? So I switched. There was real pressure at the time to go with WordPress, because that was the bandwagon everyone was jumping on, but I liked that I could understand and extend the growing codebase that was Joomla. It is, with hindsight, probably one of the best decisions I have ever made for my business.

And here is the thing about that decision: it is one I have to keep living with. Every website my agency builds is one I am tied to for years. Not the shiny launch-day version, the real one: the site the client logs into on a Friday afternoon to change a phone number, the one that needs a security update eighteen months later, the one a new member of their staff has to learn from scratch. When you run an agency you are not really choosing a CMS for a project, you are choosing the thing you and your client will be married to long after the invoice is paid. So let me tell you why, all these years later, Joomla is still the platform I reach for.

The bill nobody mentions at the pitch

Agencies live and die by their margins, so let us start with money. The trap with a lot of platforms is not the upfront cost, it is the slow drip of subscriptions. You want proper user permissions? In most systems, that means install a plugin. Multilingual, another. Custom fields, a third. A contact forms tool, a backup tool, a membership layer, each one a monthly fee, each one renewing forever, each one quietly passed on to your client or quietly eating into your profit.

With Joomla, a great deal of that is simply in the box. Access control levels so a client can edit their own pages without being able to break the site. Multilingual built into the core, not bolted on. Custom fields, content workflows, a full Web Services API, capable media handling, all part of the download. You start a project already owning the things that, elsewhere, become a subscription you can never switch off.

Keep it lean, and keep it clean

That said, here is a hard-won lesson I wish someone had told me at the start. When you begin as an agency, you are tempted by all the shiny new extensions. The marketplace is wonderful and full of them, and it is very easy to bolt a dozen onto a site because each one looks clever in the demo.

But every extension you add is, in effect, someone else's work and someone else's quality, sitting inside the site you are responsible for. It takes a while to learn the ecosystem: who the genuinely reliable developers are, and who will have moved on in a year and left their code to rot. For me, a lot of that learning came from turning up to Joomla London month after month, where the same names come up again and again as brilliant, reliable, clever people whose extensions you really can build a business on. Those are the ones that have found a permanent home in my toolkit.

In my early days I made the opposite mistake, piling sites high with every extension I fancied and leaving them there. I learned quickly that the right approach is to use the core for as much as you possibly can, and to reach for a third-party extension only when you genuinely need to. Most of my clients are not shops, so why would I bolt a full e-commerce system onto every one of them? Everything you add is another surface for someone to attack. Keeping a site lean is not just tidier, it is safer. Lean and clean wins every time.

Handing over the keys without dreading the phone

The real cost of a client site is not building it, it is supporting it. Every agency owner knows the death by a thousand "quick questions".

This is where Joomla earns its keep for me. Its permission system lets me give a client exactly the access they need and not a drop more, so the marketing assistant can publish a blog post but cannot accidentally delete the homepage. And then there are Guided Tours, which I have written about before and still think are underrated: step-by-step walkthroughs, built into the admin, that you can write for your own client. Instead of recording yet another screen-share, you build the tour once and it trains every new member of their staff for you. Think of the phone calls that puts an end to. You can brand the backend, white-label the experience, and hand over a site that feels like theirs and behaves itself while you are not looking.

Security I can defend with a straight face

When you build for clients, you carry the can for their security whether your contract says so or not. If a site you built is compromised, "well, technically that was a third-party plugin" is not a sentence anybody wants to say to a worried client. It is also, incidentally, the best argument I know for the lean-and-clean approach: the fewer moving parts, the fewer doors to lock.

Joomla lets me start from a defensible position. Updates are cryptographically signed through The Update Framework, so an update really is from the project and not from someone who got into the update server. Multi-factor authentication has been first-class in the core for years. And as I write elsewhere in this very issue, you can now offer your clients passwordless login with passkeys, which takes the single biggest cause of breaches, the password, off the table entirely. None of this is an add-on I have to remember to buy and configure. It is the platform doing the right thing by default, which is exactly what you want when the thing you are protecting is someone else's livelihood.

It grows with the client, not against them

In the early days I did build a few small blogging sites on WordPress. It seemed the obvious choice for something little. But as those sites grew, they became more and more cumbersome to maintain, until in the end I migrated them to Joomla anyway. I learned my lesson: Joomla has become so easy to use for small sites that there is no longer any reason to start a beginner site anywhere else, and starting on Joomla means the site can grow as the client grows, instead of hitting a wall.

I had exactly this with a recent client. It began life as a small brochure site, a handful of pages. Today they have teams of people writing for it. Because it was built on Joomla, growing into that was a matter of setting up workflows: letting different people contribute to different categories and sections, with gatekeepers who review and approve articles before they go live. No re-platforming, no painful migration, just the same site stretching to fit a bigger ambition. That is the quiet luxury of choosing a platform that scales with you, and the work going into the next releases is leaning hard into exactly this territory, making Joomla an even better home for your most demanding clients.

The part most platforms can never offer you

Here is the bit that took me years to properly appreciate. With most platforms you are a customer. You file feature requests into a void and wait, and a roadmap you did not write decides what your agency can and cannot do next year.

With Joomla, you can simply turn up. The people building the thing your business runs on are in the same chat rooms and at the same events as you, and they genuinely want to hear from the agencies in the trenches. Better still, you can give back through the work you are already doing. Some of the things SoftForge has built for paying clients turned out to be useful to Joomla more widely, and with the help of other developers those ideas have made their way into the core, where every agency gets to benefit from them. You do not have to become a release manager, as I somehow ended up doing, but the door is open, and an agency that puts even a little back gets a platform shaped a little more around how agencies actually work. Your competitors on closed platforms do not get a vote. You do.

So, your next project

I am not going to tell you Joomla is the right answer for every job; no honest agency owner believes that about any tool. But the next time you are weighing up what to build a client's site on, ask the question I ask: not which platform looks best on launch day, but which one you will still be glad you chose on that Friday afternoon two years from now, when the phone rings.

For far more of my agency's work than I would have guessed back when I was nursing my own broken CMS at four in the morning, the answer has been Joomla. Give it a fair look for your next project. And if you do, come and say hello, because the community is full of agency people just like you, and it is a far friendlier place to build a business than you might expect.