Is it safe to uninstall Joomla components like Banners, Contacts, News feed and search if not using them

[DonnieDarko]

Hi,
We are trying to improve the speed of our Joomla 3.5.1 site and we realised that there are quite a few core components that we would never use, such as Banners, contacts, messaging, news feed and search. My questions are:
1. Will there be any performance (speed) improvement if we disable/remove these core components?
2. If there is any improvement, will disabling them the same as removing them?
3. Are there any potential issues of removing these components, for example will there be errors later when updating/upgrading Joomla?

[numinousmedia]

I've been getting rid of unwanted core components for the last few years, not so much because they make a huge speed difference, but because I wanted to simplify my admin interface as much as possible, especially for end clients.

So to answer your questions...

1. Probably there will be little to no speed improvement by eliminating these components. If there is any improvement, I think it will be minimal.
2. I think the answer to this is yes, disabling would create about the same effect as removing them. If were were talking about a security vulnerability, I would urge you to completely remove the offending extension, but since we are looking for speed improvements, disabling them is probably a better, less destructive route.
3. I routinely remove banners and news feed on my own sites because I just about never use them. I've also removed contacts without causing any trouble. You should be okay removing saerch, but this is one that I've never messed with. I think in all of these cases, disabling will provide a non-destructive way of handling these issues.

[deleted user]

Yes there are issues with removing the core components.

1) Their files end up back on the filesystem anyway because they're packaged with the core updates.
2) If there are any SQL statements to be run during the update involving the database tables from those components and those tables aren't present, the update fails critically.

Just disable them. Joomla will not execute disabled extensions (from that perspective it's as good as uninstalling them) so even if there is a security vulnerability involving them a potential hack would either have to direct execute an offending file or get malicious files onto your server to trigger the offending code (in which case you've got bigger issues anyway).

[DonnieDarko]

Thank you both for your reply and they are very helpful. In this case since all the components I am referring to are Joomla core components, having them disabled wouldn't increase any potential hack risk would it? Basically when Joomla update itself, it would update these components if necessary even they are disabled on the site?

[sovainfo]

The potential hack risk decreases from core, core with disabled extensions, core with extensions removed.
But that is a rather theoretical situation, you can't abuse what is not there.

The update of Joomla expects these extensions to be there, they don't need to be active, just there. They'll be updated regardless whether they are disabled.

When removing extensions from core, suggest to change your update procedure. Adjust the patches and remove references to those extensions there as well. That means files, table changes and script.php.

[DonnieDarko]

Thank you, that's all clear now.