MuRu Guard 5.5.0: Stop Joomla Spam and Fake Registrations Without Losing Real Visitors

MuRu Guard 5.5.0 brings Joomla spam protection to every form and every sign-up on your site. The new Spam Shield stops contact form spam, fake registrations and form floods, and it answers the question every spam tool leaves open: what happens to the real customer who gets caught by mistake? Here, they keep everything they typed and send it with one click. This release also makes MuRu Guard ready for PHP 8.5.

Watch the Spam Shield tutorial

Every setting, and what a visitor actually sees, in under five minutes: switching on each check, the safety settings, the monitor-only period, a real message going through, a spam message being refused and confirmed, and the log.

• The tutorial
• Why Joomla sites get so much spam
• A trap only bots fall into
• No more fake registrations
• A send limit and a spam score
• Built so real visitors never lose out
• See every refusal
• Ready for PHP 8.5
• Upgrade checklist
• FAQ

Why Joomla sites get so much spam

Spam bots don't read your site. They scan the web for any page with a form, fill in every field they find and submit it in a fraction of a second, thousands of times a day. Contact forms, registration pages, comment forms and form builders are all targets. Fake registrations are worse: they fill your user list, message your members and hurt your mail reputation.

The usual answer, a CAPTCHA, slows real people down and still lets many bots through. The Spam Shield takes a different approach: it watches for the things bots do and people don't. It has four checks, and you switch each one on separately.

A trap only bots fall into

Every front-end form gets a hidden field that people never see, a so-called honeypot. Bots fill in every field, so they fill this one too, and the form is refused. A short timing check refuses forms sent faster than anyone could type them, under 2 seconds by default.

Log-in forms, short forms and forms that are already filled in, such as a profile page, are never timed, so password managers and returning visitors are never affected. It covers Joomla's contact form and registration, comment forms and form builders such as SP Page Builder, RSForm, Convert Forms and Chronoforms.

[SCREENSHOT: the Spam Shield tab with the form spam check switched on]

No more fake registrations

The new-account check looks at every account created from the front end, whichever extension creates it: Joomla's own registration and community extensions such as EasySocial, CRE8 Social, Community Builder and JomSocial. It refuses:

• Disposable email addresses, from a list of more than 10,000 throwaway email domains.
• Too many new accounts from one network in an hour, 3 by default.
• Countries you choose, if your site only serves certain regions.

The visitor sees a short, clear message saying why, so a genuine user knows exactly what to do. Accounts created in the administrator are never checked.

A send limit and a spam score

Built so real visitors never lose out

A blocked bot is good. A blocked customer is a lost sale. That is why the Spam Shield comes with safeguards you control:

• Confirm and send again. If a real person is ever caught by mistake, everything they typed is kept on a confirmation page and one click sends it. The button only works in a real browser after a few seconds, so bots stay refused.
• A safe start. Each check you switch on only logs what it would have refused for its first 48 hours. Change the hours in Options, Site Protection.
• Log-only mode. Run every check for as long as you like without refusing anyone.
• Limits counted per visitor. People who share one network, such as an office, a school or mobile users, each get their own limit, with a cap for the network as a whole. The small cookie that makes this work holds a random ID only, no personal data.
• Your own exceptions. Skip a whole component, a single form or a page address, and mark email domains, such as your own company's, as always allowed.
• Administrators and allow-listed IPs are never checked.

[SCREENSHOT: the confirmation page a refused visitor sees, with the Send my form button]

See every refusal

Every refusal, and every check that only logged, is listed in Threat Monitor, Recent events with its reason, IP address and page. The list of checks in their monitor-only period shows how many times each one would have refused, so you can decide when to let it act. Switch on the daily summary and you get at most one e-mail a day listing what was refused, where and why.

[SCREENSHOT: Recent events listing a refused spam message and a refused disposable email sign-up]

Ready for PHP 8.5

MuRu Guard now reads response headers the way PHP 8.5 expects, so no deprecation notices appear in your logs when your host upgrades PHP.

Upgrade checklist

FAQ

MuRu Guard has a free core: scanning, cleanup and Protection Mode keep working without an account, and Pro adds the Spam Shield along with the deeper audits, alerts and reports. Update today, switch on the checks you need, and let the safe start show you how much spam your forms have been taking.