Pretty Reviews is a Joomla site module that displays Google business reviews in a responsive, multi-column carousel. It fetches reviews from the Google Places API, stores them in a local JSON cache, and lets you choose how reviews are shown on the frontend.
- Display Google rating, review count, review text, author names, profile photos, star ratings, and a "View all reviews" link.
- Optional "Leave a review" button that opens Google's review form for the configured Place ID.
- Reviewer profile photos are stored on your own site and served from your own domain, so displaying the reviews sends no visitor data to Google. Reviewers whose photo could not be downloaded get a locally generated avatar with their initials.
- Choose from Bootstrap layouts (Default, Card Carousel, Compact), UIkit/YOOtheme layouts (UIkit Default, UIkit Compact, UIkit List), plus a simple List and a classic Legacy layout.
- Set responsive column counts per breakpoint — 1 to 6 reviews side by side for mobile, tablet, desktop, and wide screens — in the carousel layouts.
- Bootstrap layouts use a native CSS scroll-snap carousel: native touch swipe, one-column-at-a-time navigation, a usable scrollable fallback without JavaScript, and no inline styles (CSP-friendly). UIkit layouts use UIkit's native slider.
- Optional autoplay with a configurable interval (1–60 seconds).
- Fetch reviews manually from the Joomla module edit screen.
- Optional scheduled refreshes through the companion task plugin.
- Keep Google API credentials server-side; the browser only sends the module ID and Joomla CSRF token.
- Sort fetched reviews by Google's "most relevant" or "newest" mode.
- Display reviews by newest first or random order.
- Limit the number of displayed reviews.
- Hide reviews without text.
- Multilingual language files: English, Dutch, German, French, and Italian.
- Joomla 4, 5, or 6.
- PHP version supported by your Joomla installation.
- A Google Maps Platform API key with access to the Places API.
- A Google Place ID for the business you want to show reviews for.
- Download the latest release ZIP from the GitHub releases page.
- In Joomla Administrator, go to System -> Install -> Extensions.
- Upload and install the ZIP.
- Go to Content -> Site Modules.
- Create or edit a Pretty Reviews module.
- Configure the Google Place ID and API key.
- Save the module, then click Update Reviews in the toolbar.
Latest release: https://github.com/TLWebdesignNL/Pretty-Reviews/releases
Pretty Reviews 1.2.0 and newer fetches Google reviews server-side. That means Google sees the request as coming from your server, not from the visitor's browser.
Recommended key restrictions:
- Application restriction: IP addresses.
- Add the public server IP address of the website.
- API restriction: restrict the key to the required Google Places API.
Do not use HTTP referrer-only restrictions for this module's server-side refresh. Google will reject the request with a message similar to:
REQUEST_DENIED: This IP, site or mobile application is not authorized to use this API key.
The Place ID of the Google Business Profile location. Google documents how to find it here: https://developers.google.com/maps/documentation/places/web-service/place-id
The API key used for the Google Places request. Keep this key restricted to the website server IP and the required Places API.
Chooses which Google API the reviews are fetched from:
- Places API (Legacy), the default and what every earlier version used. Google no longer enables it for new Cloud projects, and it cannot find some businesses, such as service-area businesses without an address (it answers
NOT_FOUNDfor their Place ID). - Places API (New), which finds those businesses too. Enable "Places API (New)" in the Cloud project and allow it in the key's API restrictions; otherwise Google answers
PERMISSION_DENIED/API_KEY_SERVICE_BLOCKED.
Both store the same review data, so switching keeps the reviews already cached. Places API (New) has no sort option and always returns the most relevant reviews, so the fetch sort below is only shown for the legacy API.
Only applies to Places API (Legacy). Controls how Google sorts the reviews returned by the API:
- Most relevant
- Newest
Google returns a limited review set. This option controls the upstream fetch, not only frontend display.
Maximum number of cached reviews to display on the frontend. Leave empty or set to 0 to show all cached reviews.
Controls how cached reviews are displayed:
- Newest
- Random
When enabled, reviews without text are hidden on the frontend.
Reviews by the reviewers listed here are hidden on the frontend. Enter one name per line, exactly as Google shows it; upper and lower case and extra spaces do not matter, but the whole name has to match, so Anna does not hide Anna Müller. The reviews stay in the cache, so removing a name shows them again.
Enable Show "Leave a review" button to link visitors directly to Google's review form. By default, the module generates the link from the configured Google Place ID without making another API request.
You can optionally paste the review link supplied by Google Business Profile into Direct review URL override.
Each carousel layout (Default, Card Carousel, Compact, UIkit Default, UIkit Compact) can show a different number of reviews side by side per breakpoint. Set Columns on mobile / tablet / desktop / wide screens to any value from 1 to 6.
The Bootstrap layouts apply the column count with CSP-safe utility classes on a CSS scroll-snap track (no inline styles), and the UIkit layouts use UIkit's native responsive grid. The List, UIkit List, and Legacy layouts do not use columns, so these settings are hidden when one of them is selected.
Modules upgraded from a pre-2.0.0 release are kept at a single column on every breakpoint so their appearance does not change after the update; adjust the settings to opt in to multiple columns.
Enable Autoplay to advance the carousel automatically, and set the Autoplay interval (1–60 seconds) to control the delay between steps. The interval field appears only when autoplay is enabled. Autoplay pauses on hover/focus and is disabled for visitors who prefer reduced motion.
Open the module edit screen in Joomla Administrator and click Update Reviews.
The refresh action:
- requires the Joomla form token;
- requires edit permission for the module;
- reads the Google credentials from the saved module parameters;
- writes the raw review cache to
media/mod_prettyreviews/data-{module_id}.json; - downloads any reviewer photos it does not have yet to
media/mod_prettyreviews/images/{module_id}/, and removes the ones no cached review uses any more; - spends at most about fifteen seconds downloading photos per run to keep the request quick, and reports in the success message how many are still waiting, so you know to press the button again on a slow connection;
- returns clear feedback when Google rejects the API request.
Save the module before the first refresh so Joomla has a module ID and stored credentials to use.
Automatic updates are handled by the companion task plugin:
https://github.com/TLWebdesignNL/Pretty-Reviews-Task-Scheduler-Plugin
Use version 1.1.0 or newer of the task plugin with Pretty Reviews module 1.2.0 or newer. The task plugin calls the module helper directly and no longer sends credentials through an HTTP request.
Reviewer photos are never loaded from Google by your visitors' browsers. Each photo is downloaded once and
stored under media/mod_prettyreviews/images/{module_id}/, and the layouts point at that copy.
Photos are collected when the reviews are refreshed — the Update Reviews button, or the task plugin. A reviewer whose photo could not be downloaded gets an avatar generated from their initials instead, so no request ever leaves for Google. A cache created before this feature existed has no stored photo to point at yet, so its reviewers are shown the same initials avatar until the next refresh replaces them with the real ones; nothing is ever downloaded while a page is being viewed. Updating a site that already has reviews cached says so once, in a message on the update screen, so that first refresh is not forgotten.
Only images from Google's own photo hosts are accepted, over HTTPS, up to 2 MB and 4096 pixels a side, and only after the downloaded bytes are confirmed to be a JPEG, PNG, GIF or WebP. Anything else is refused and the initials avatar is kept. Redirects are followed by the module rather than by the HTTP client, at most three hops, and every hop is checked against those hosts again.
A photo that will not download is tried again on the next refresh. One that fails twice in a row is left
alone for an hour, so a photo that is gone for good stops spending the download time the other reviewers
need. The image folder is created with an empty index.html, so a server with directory listing left on has
nothing to show.
Purge Reviews removes the stored photos along with the cached reviews.
Update to Pretty Reviews 1.2.0 or newer. Older refresh logic could treat an invalid Google response as a successful write. Current versions reject invalid Google responses and keep the error visible.
Check the Google API key restrictions. Because refreshes are server-side, the key must allow the website server IP address. HTTP referrer-only restrictions will not work.
Fill in both fields, save the module, and then run Update Reviews.
Update this module before using the task plugin. The task plugin depends on the helper API introduced in Pretty Reviews 1.2.0.
Check:
- the module is published;
- the module is assigned to the correct menu items;
- the selected template position exists;
- the JSON cache file contains reviews;
- your display limit, "hide empty reviews" and "hide reviewers" settings do not filter every review.
Pretty Reviews 1.2.0 removed the old URL-secret refresh flow. The browser no longer receives the Google API key, Place ID, review sort value, or static secret in request URLs or data-* attributes.
The backend refresh now uses:
- Joomla CSRF token validation;
- per-module
core.editpermission checks; - server-side credential lookup from the module record;
- Joomla's HTTP client for Google API requests;
- escaped review output in the frontend layout.
Downloaded profile photos are restricted to Google's photo hosts over HTTPS, capped in size, and stored only when the downloaded bytes decode as a known image format — the file extension comes from that check rather than from the URL, and a remote SVG is always refused. Redirects are resolved by the module instead of the HTTP client so that every hop is checked against the allowed hosts, not just the URL the fetch started from. Stored filenames are validated again before they are put into a page.
The module has no build step and no Composer dependencies. To run the tests:
php tests/run.phpEach test file runs in its own process against a temporary site root, standing up just enough of Joomla's filesystem, HTTP and URI classes to exercise the helpers. The tests are excluded from the release archive.
The module includes a Joomla update server:
https://raw.githubusercontent.com/TLWebdesignNL/Pretty-Reviews/main/updates.xml
Release changelog:
https://raw.githubusercontent.com/TLWebdesignNL/Pretty-Reviews/main/changelog.xml
- GitHub: https://github.com/TLWebdesignNL/Pretty-Reviews
- Releases: https://github.com/TLWebdesignNL/Pretty-Reviews/releases
- Issues: https://github.com/TLWebdesignNL/Pretty-Reviews/issues
- Joomla Extensions Directory: https://extensions.joomla.org/extension/pretty-reviews/
- TLWebdesign: https://tlwebdesign.nl/
GNU General Public License version 2 or later.