MuRu Guard v5.1, flood protection and new security audits for Joomla

MuRu Guard 5.1 adds flood protection to the Shield firewall and four new read-only audits that look at places a malware scan cannot: your database permissions, your mail DNS, your update sources and Joomla's own action log. The admin interface also got a clearer, more consistent look.

Firewall: rate limiting, method and User-Agent rules (Pro)

The old Request blocking group in Site Protection is now called Firewall. It gains three opt-in rules. Rate limiting temporarily blocks an IP that sends more requests than you allow in a time window (the default is 120 a minute, with a 10-minute block). You can also refuse unusual HTTP methods such as TRACE, TRACK and CONNECT, and requests that send no User-Agent at all. The backend and your allow-listed IPs are never limited, and every refusal appears in the Protection Log. Find it under MuRu Guard > Settings > Site Protection > Firewall. These rules need Shield plugin 2.1.0.

Database privilege audit (Pro)

When a plugin has a SQL injection flaw, what an attacker can do next depends on what your database user is allowed to do. The new audit reads the grants and flags FILE, SUPER, CREATE USER, RELOAD, SHUTDOWN, PROCESS and GRANT OPTION, each with the exact REVOKE statement to fix it. It only reports. Nothing is revoked for you. It lives under Settings > Analysis.

Joomla Action Log review (Pro)

Joomla already records who installed an extension or changed a user group, but few admins read it. MuRu Guard now pulls out the security-relevant entries (installs, user and group changes, configuration, template and module saves), with 24-hour, 7-day and 30-day views. The scheduled check emails you when a new install or privilege change appears. If Joomla's action logging is switched off, the card says so instead of showing a false all-clear.

Update source integrity and mail authentication (Pro)

The update source watch flags plain-HTTP update sources and emails you when any source is added, removed or has its address changed. The mail authentication audit checks SPF, DMARC and DKIM for your sender domain and tells you what to fix, using read-only DNS lookups.

Better scan feedback and a clearer interface

The scan screen now shows a red dot and a running count as soon as something suspicious turns up. Tabs stay pinned while you scroll in Site Protection and Analysis, the open tab is easy to spot, and Settings, Smart AI Assistant and Help share one visual style. The live-verification window also checks clickjacking protection, Referrer-Policy, backend page headers and server version disclosure.

Fixes and detection updates

Search code by snippet (Pro) now finds multi-line fragments, handles Windows line endings and searches .inc, .phtml and .htaccess files. The scanner also flags x-kay.php.json and kepalabapakkau.php.json from the Helix3 campaign, which is available in Free too.

Free vs Pro in this release

• Free: the new malware filenames, the live found-so-far scan indicator and the interface updates.
• Pro: rate limiting, method and User-Agent rules, the database privilege, Action Log, update source and mail authentication audits, the extra header probes and the code-search fixes.

How to update

Back up your site, then open Joomla > System > Update and install MuRu Guard 5.1.0 along with Shield plugin 2.1.0. Pro customers can also download both from My Products. Joomla 3 sites receive the matching Pro edition separately.

What's next

See the changelog and roadmap for what is planned.

Explore MuRu Guard Security Scanner