MuRu Guard 5.2.0 Released: Threat Monitor, Upload Lockdown, Security Grade and More

MuRu Guard 5.2.0 is a big release. It adds 18 new features, changes four behaviours and fixes four false alarms, and it answers the question most Joomla security tools leave open: what has your site actually been blocking, and how worried should you be? There is a new Threat Monitor, an A to F security grade, an emergency Upload lockdown, a PHP security banner on the dashboard, new Pro audits, tunable alerts and a scheduled client report.

MuRu Guard 5.2.0 in 90 seconds

The short version: what is new, why it matters and who it is for.

Watch the full tour

Every screen of MuRu Guard in under four minutes: the dashboard, the Firewall, Login protection, Hardening, the Analysis audits, the Threat Monitor and the AI assistant.

• The 90-second overview
• The full tour
• See what your site is blocking
• A grade, a clean banner and a PHP warning
• An emergency brake for uploads
• Catch a broken PHP block in uploads
• Smarter firewall rules
• New audits for PHP, backups and passwords
• Alerts you can tune, and a report for clients
• Fewer false alarms
• Upgrade checklist
• FAQ

See what your site is blocking

The new Threat Monitor tab under Settings turns the Shield log into something you can read at a glance. You get attacks over time by severity, the rules that fire most, the types of attack, a recent-events list and a threat level from Low to Critical. Critical is reserved for a confirmed compromise, such as a tripped honeypot. High means ten or more high-severity events, and Medium means at least one high-severity event or a steady run of medium ones.

Everyone gets the 24 hour and 7 day views, the last five scans and the latest Joomla security announcements. With Pro you also get 30 and 90 day views, top source IPs and countries, failed logins by hour of day, the paths attackers target, and your score, open findings and file changes scan by scan.

The recent-events list replaces the separate Protection Log screen, so there is one place to look. Pro can filter it by level, result, rule and IP, page through every match, export it as CSV, and block or safelist an IP from any row. Free shows the latest 50 events and can still block an IP.

[SCREENSHOT: the Threat Monitor tab showing the threat level, attacks over time and the recent events list]

A grade, a clean banner and a PHP warning

The security score now carries a letter. 90 and up is an A, then 80, 70 and 60, and anything lower is an F. Joomla core and PHP status now count in it: a core with an update waiting, a branch that no longer receives security fixes, or an end-of-life PHP lowers the score.

When a scan finds nothing and none of your extensions matches a known vulnerability, the dashboard tells you so: "Your site is clean and protected" with the checks that passed. It only says "protected" while Protection Mode is really running and the score is 80 or higher. Otherwise it says "No malware found" and tells you how many other items still lower the score, so the banner never overpromises.

The new PHP version banner turns red when PHP has published security releases newer than the one your server runs, and says how many you are missing and which version to move to. It turns amber when your PHP branch is past its security support. If php.net cannot be reached the banner stays quiet instead of guessing.

[SCREENSHOT: the dashboard with the clean-and-protected banner and the PHP banner]

An emergency brake for uploads

When a file-upload vulnerability is published, you often have days before the vendor's patch is ready. The new Upload lockdown (Settings, Site Protection, Emergency) adds one managed rule to your .htaccess that refuses every request carrying multipart/form-data, which is how files are uploaded. It is on for 1 to 72 hours or until you switch it off, the administrator area is spared by default, and a banner on the dashboard tells you it is on.

Catch a broken PHP block in uploads

Blocking PHP in your upload folders is one of the cheapest defences against a dropped webshell, and one of the easiest to undo by accident. With Pro, Guard now watches that rule. It alerts you when the rule is removed or edited, or when a folder stops refusing PHP, shows a red row on the dashboard, and offers a one-click Re-apply. Media, images, uploads, tmp, cache and files are each verified on their own, so the one folder that would run a dropped file is named.

Smarter firewall rules

New audits for PHP, backups and passwords

Three new Pro audits live in the Analysis tab. They are read-only reports that tell you what to change and where.

• PHP configuration audit: grades allow_url_include, display_errors, expose_php, disable_functions, open_basedir and the session cookie settings.
• Backup freshness check: reads Akeeba Backup's records and warns when the newest successful backup is older than your limit or the last run failed. A stale backup also lowers the score.
• Weak administrator password check: tests Super User, Administrator and Manager passwords against a short list of very common ones, on your own server. Only a yes or no per account is kept.

Alerts you can tune, and a report for clients

Alert rules let you alert on High findings only, switch individual watches off and set quiet hours. Alerts that fire inside quiet hours are held and sent as one e-mail afterwards. The scheduled client report is a weekly or monthly e-mail with the score and its change, findings opened and closed, attacks blocked, backup, certificate and Joomla status. Agencies can send it to the client without opening the dashboard.

Fewer false alarms

This release also spends real effort on false positives. "Hacked by" no longer matches code comments, sidecar files such as .lock, .pubkey and .md5 no longer look like double-extension shells, and rotated host logs like error_log.1 are no longer flagged. The vulnerable-extension checks no longer blame look-alike add-ons or Joomla's own plugins for another product's advisory, and an extension newer than every version an advisory names is no longer reported. Scan results also return to the Run a scan screen after five minutes of inactivity, and the dashboard's "See the PHP audit" button now opens the right place.

Upgrade checklist

FAQ

MuRu Guard 5.2.0 has a free core: scanning, cleanup, Protection Mode, the Threat Monitor basics and the Upload lockdown keep working without an account, and Pro adds the deeper audits, alerts and reports. Install it, watch the tour above, open the Threat Monitor, and see what your site has been stopping.