How to Create a Custom Joomla Access Level

Design the audience before creating the level

List the user groups that should receive the new viewing level. Review the group hierarchy as well as direct group assignments so you understand the effective audience. Keep this decision separate from action permissions: receiving a viewing level does not grant editing or administrative capabilities.

Create the access level

1. Sign in to Joomla Administrator.
2. Go to Users → Access Levels.
3. Select New.
4. Enter a clear title that describes the intended audience.
5. Select the user groups that should receive this viewing level.
6. Save and close.

Use a name that will still make sense to another administrator later, such as Members, Staff Portal, or Client Area, rather than a temporary project label.

Assign the level to resources

Creating an access level does not protect anything by itself. Edit each relevant article, category, menu item, module, contact, or other access-aware object and choose the new level in its Access field. Protect the underlying resource even when its menu item or module is also restricted.

Avoid repurposing a widely used level

Changing the groups in an existing access level can immediately change visibility for every object assigned to it. Before modifying a shared level, determine where it is used. For a genuinely new audience, a new custom level is often safer and easier to audit.

Test both sides of the rule

1. Sign in as a user in a group that should receive the level and confirm the protected resource is visible.
2. Test a user who should not receive the level.
3. Test the resource by direct URL, not only through its menu item.
4. Check related modules and navigation for consistent access.

If the wrong user receives the level, inspect all of that user's groups and the groups selected in the access level before changing unrelated permissions.

Document the level's purpose

For complex sites, record why the level exists and which groups are intended to receive it. This makes later ACL audits safer, especially when user groups, memberships, or private content areas change over time.