MuRu Guard 5.3.1 Released: A Wider Scan, Safer Logs, No Proxy Lock-Outs and More

MuRu Guard 5.3.1 is a security and reliability release. We put MuRu Guard through an in-depth security review, area by area, from access control to detection quality. Every finding was checked against the code, and the most serious ones were reproduced on a test site before and after the fix. This release fixes what that review found. Scans now look in more places, the evidence MuRu Guard keeps can no longer be erased by a visitor, the Shield never locks your own site out, and from this version the Shield plugin updates itself.

• Scans look in more places
• Your evidence stays put
• Shield blocks better and never locks you out
• Tighter control over powerful actions
• Updates, uninstall and Joomla 7
• Upgrade checklist
• FAQ

Scans look in more places

A clean scan is only worth something if the scanner looked everywhere a backdoor can live. 5.3.1 widens what MuRu Guard reads:

• More folders. The api, includes and language folders are now scanned, together with loose files directly in administrator/.
• Known files are read, not just recognised. configuration.php, .htaccess and .user.ini at the site root used to be skipped by name. They are now checked for malicious code.
• PHP settings that keep a backdoor running. An auto_prepend_file or auto_append_file setting, and an AddType or AddHandler rule that runs an image or text file as PHP, are reported.
• More webshell shapes. Request data passed straight into command, code, include, callback or file-write functions is reported, including forms split over two lines.
• No easy hiding places. Folders named after trusted security extensions are skipped only when that extension is really installed, and MuRu Guard's own quarantine folder and honeypot file are scanned unless they hold exactly what MuRu Guard put there.
• Checks that cannot finish are retried. A stray invalid character or a very long line no longer hides a file from a content check.

We checked the wider scan against a clean Joomla 6 site with SP Page Builder: it reported nothing new, so the extra coverage does not mean extra noise.

[SCREENSHOT: scan results with a finding in configuration.php or .user.ini]

Your evidence stays put

When something goes wrong, the Protection Log and the scan history are what you look at first. 5.3.1 makes sure they are still there:

• A single failed login with an unusual username or browser string can no longer empty the Protection Log, and very long values can no longer bloat it until the MuRu Guard screens fail to load.
• A file with an unusual name no longer erases the saved scan history, so scheduled alerts keep coming. If that history is ever lost, every finding is reported as new instead of none.
• Undoing several AI edits to one file brings back the original, and restore points of files that start with a blank line can be restored again (Pro).
• Settings saved at the same moment as a license check no longer overwrite each other.

Shield blocks better and never locks you out

• No lock-out behind a proxy. On a site behind a load balancer or reverse proxy, every visitor can look like the proxy. Private and proxy addresses are now never auto-blocked or brute-force blocked, automatic blocks expire after 24 hours, and the list is capped.
• Brute-force counting groups IPv6 by network. Moving through addresses inside one network no longer resets the count.
• The firewall sees what was sent (Pro). Requests are checked before Joomla tidies them and after decoding, and JSON bodies are checked too. A rule that slowed down on large requests now runs in a fraction of a millisecond, and searches such as "sleep (tips)" are no longer blocked.
• Virtual patches on pretty URLs (Pro). Rules are checked again once Joomla knows which component a search-engine-friendly URL belongs to.
• Admin Lockdown covers more. While it is on, new users from any backend screen or the Web Services API, Joomla Update package uploads and template file editing are blocked as well as the extension installer.
• More upload names refused. More executable extensions, server configuration files, names with trailing spaces and Media Manager uploads are checked.
• Problems are visible. If a protection check ever fails, Shield still lets the request through, as before, but the Site Protection tab now tells you it happened.

[SCREENSHOT: Settings, Site Protection with the Shield settings]

Tighter control over powerful actions

• Super Users only for the most powerful actions. Writing files with the AI assistant, restoring files, changing .htaccess, Emergency Mode, Upload lockdown, incident response and importing settings now need a Super User, even for a group you gave MuRu Guard's Configure permission.
• AI changes run exactly as approved (Pro). The server runs only the change shown on the confirmation card, once, and paths are checked in their real form.
• Blocking a Super User sticks. When you block, demote or remove an account in the backend, protected users follow your change instead of undoing it, and nothing is reverted during incident response.
• Pro protection stays on during a license-server outage (Pro). A license last confirmed active keeps working for 7 days if the license server cannot be reached.
• Safer exports and search. Exported findings open safely in a spreadsheet, and searching code or exporting matched code needs Configure access.

Updates, uninstall and Joomla 7

• The Shield updates itself. From 2.3.1, the Shield plugin has its own update channel in Joomla's updater, using the same license key as the component.
• Uninstall leaves your site open. Uninstalling removes MuRu Guard's access rules from .htaccess (Emergency Mode, Backend Access, Upload lockdown, Exposure block). Your own rules, and the rule that blocks PHP in upload folders, stay.
• The installer checks the site first: PHP 8.1 and Joomla 4.4 or newer, and from this version a newer MuRu Guard is never replaced by an older build.
• No third-party script runs on MuRu Guard pages: its styles now ship with the extension.
• Ready for Joomla 7. Calls Joomla has marked for removal are replaced.

Upgrade checklist

1. Update the MuRu Guard component to 5.3.1.
2. Install the Shield plugin 2.3.1 by hand this one time. Later Shield updates arrive through Joomla's updater.
3. Run a full scan and review anything new in the folders and files that are now checked.
4. If you gave another group MuRu Guard's Configure permission, note that the actions above now need a Super User.
5. Setting a new secret administrator URL? It now needs at least 12 characters. An existing shorter one keeps working.

Frequently asked questions

MuRu Guard 5.3.1 keeps the free core you know: scanning, cleanup, Protection Mode and the Threat Monitor basics work without an account, and Pro adds the deeper audits, the firewall and the AI assistant.