🛡️ Free & Open Source Joomla Extension Real-Time Protection September 2026 · 9 min read

MuRu Guard: The Free, Always-On Security Scanner for Joomla — and What Pro Adds

Most Joomla security advice is reactive: something goes wrong, you find a scanner, you clean up, you move on until the next incident. MuRu Guard is built to sit in your admin panel permanently instead — a free, always-installed component that scans on demand, watches every request in real time through its companion plugin, and locks down the exact actions attackers use to turn a single compromise into a permanent foothold. Full scanning, cleanup, and real-time Protection Mode are free forever, with no restrictions; a paid Pro layer adds file integrity monitoring, an active firewall, an AI assistant that can fix what it finds, and fleet-wide monitoring for anyone managing more than one site.

What MuRu Guard Actually Scans For

MuRu Guard started as a response to a real, specific attack — the SP Page Builder uploadCustomIcon unauthenticated RCE, and the JCE editor infections that followed it on the same sites. That origin still shows in how targeted its detection is, but it doesn't stop there: it also checks for the generic patterns real-world Joomla compromises share, no matter which extension let the attacker in.

Filesystem & content signatures

media/, images/, templates/, tmp/, cache/, and the webroot itself, checked against known webshell patterns, stream-wrapper payload loading, obfuscated decoding, and self-replicating dropper logic.

Core entry-point integrity

Any code executing before Joomla's own _JEXEC bootstrap in index.php or the other core entry points is treated as confirmed, actively-running compromise — not a heuristic guess.

Core-file checksum verification

Detects your exact Joomla version and compares core files byte-for-byte against the official joomla/joomla-cms release hash — proof of tampering, independent of every pattern-based check.

Database & users

Checks #__menu for Helix Ultimate mega-menu XSS injections, #__sppagebuilder_assets for rogue iconfont/eval rows, #__template_styles for defacement, and flags Super User accounts matching known attacker naming patterns.

Every finding is labeled High or Medium confidence, so you can triage the obvious cases first instead of reading through a wall of undifferentiated results.

Chunked, resumable scanning

A scan no longer runs inside one blocking request. It's broken into small pieces — one directory area, the database check, and so on — each bounded to a fixed time budget, with a real progress bar in the browser. A large site's scan can't come back as a bare "500 — Whoops" from hitting a host's execution-time limit, regardless of site size.

Protection Mode — Catching Attacks in Real Time

On-demand scanning finds an infection after it's already happened. Protection Mode, via the companion plg_muruguardshield plugin, checks every single request to your site as it happens — the only extension type Joomla runs on every page load, before routing even happens.

Step 1 — Install and enable the companion plugin

It does nothing on its own — everything is controlled from the scanner's own Settings panel, and it fails open (never takes the site down) if a check throws or the component isn't installed.

Step 2 — Turn on Protection Mode

The master switch. Detects and logs every match with zero risk of blocking a real visitor by itself — safe to leave on alone.

Step 3 — Opt in to active blocking (optional)

Block high-confidence attack patterns rejects webshell interaction, a direct probe against the SPPB RCE, and known malware-drop filenames with a 403. Block brute-force login attempts rejects further backend logins from an IP once it crosses a threshold. Lower-confidence matches are always logged only, never auto-blocked.

Everything detected — blocked or not — appears in the Protection Log, sectioned into Attack Pattern Matches and Brute-Force Login Attempts, each row showing IP, timestamp, severity, matched rule, and whether it was actually blocked.

All three switches are off by default

Already-authenticated, non-guest admin sessions are exempt from request-pattern blocking, so a legitimate action can never trip a false block and lock you out of your own site. If your site sits behind a reverse proxy or CDN that doesn't forward the real client IP, check that before relying on brute-force blocking in production.

Admin Lockdown, Protected Users & Test a Request

Three newer additions, all off by default, aimed at a specific failure mode: a compromised admin session turning itself into a permanent foothold.

Admin Lockdown

Blocks the extension installer and creating new backend users while on, so a compromised session can't install a malicious extension or spin up a fresh Super User. Never blocks core updates or editing an existing user.

Protected User Snapshot & Auto-Revert

Snapshots every Super User and watches for tampering. A protected account getting blocked or removed is reverted automatically; an email/password change or deletion is alerted immediately but never auto-reverted, since that could be something you did yourself.

Test a Request

Paste a URL, IP, or User-Agent and see exactly what Shield would do with it — blocked, flagged, or allowed, and why — before turning any blocking switch on at all. Read-only; never writes to the attack log or affects real traffic.

Guided Cleanup, Not Guesswork

Finding something is only half the job. When MuRu Guard flags an issue, it also gives you a safe way to act on it:

→ Scoped deletion — only files/folders flagged by the current scan run can be removed; top-level Joomla folders are hard-protected regardless.
→ Code Issues preview — before cleaning a file, see the exact bytes an auto-fix would remove (and what replaces them) before running it.
→ Surgical menu-item cleaning — strips only the known injection markers out of a menu item's params JSON, field by field, leaving every legitimate layout setting untouched.
→ Confidence-first triage — review High findings, then Medium; a core entry-point finding means the site is actively compromised right now, not just historically infected.

Scheduled Scanning & Alerts

Point any cron system at a webcron URL and get an email only when something new shows up — not on every run, and never on the very first run, which just records a baseline. Turn it on in Settings, generate a token, save, and add a job to your host's cron panel or a free external cron service:

0 3 * * * curl -fsS "https://yoursite.example/administrator/index.php?option=com_muruguard&task=scanner.scheduledcheck&token=YOUR_TOKEN" >/dev/null

This reuses the exact same detection logic as a manual scan — including core-checksum verification — it just tracks what's new between runs.

Installing MuRu Guard

Step 1 — Download both packages

com_muruguard (the scanner, required) and plg_muruguardshield (the optional real-time protection companion).

Step 2 — Install via System → Install → Extensions

Upload the component first, then the plugin. The scanner appears under Components → MuRu Guard once installed.

Step 3 — Enable the plugin

Under System → Manage → Plugins, search "MuRu Guard Shield" and toggle it on. It stays inert until Protection Mode is also turned on from the scanner's own Settings.

Step 4 — Run your first scan

Open Components → MuRu Guard → Scan, click Run a Scan, pick which directories/checks to include (or leave everything selected), and review the results.

No API keys, no separate login

Access control is entirely handled by Joomla's existing user/session/ACL system — the free edition's only outbound calls are Joomla's own standard update check, and, if you explicitly submit it, the optional newsletter form.

Free vs. Pro — What Each Level Gets You

Scanning, cleanup, Protection Mode, Admin Lockdown, and everything above is free forever, no restrictions. Pro adds a layer on top for site owners who want more:

File Integrity Monitoring

Catches what signature scanning can't — a backdoor hand-inserted into a file you already trust. Baseline once, then get alerted the instant any of them silently changes.

Active Web Application Firewall

Blocks generic SQL injection, XSS, file inclusion, and command-injection patterns in incoming requests — broader than Protection Mode's webshell-specific checks, which stay on regardless.

Smart AI Assistant

A chat-based assistant, right inside the admin panel, that reads, searches, and fixes your Joomla project's code on request — bring your own Claude, GPT, Gemini, OpenRouter, or custom-endpoint key.

Backup & Restore (TimeMachine)

Every AI-driven or bulk repair action is automatically snapshotted first — pin one to keep it forever, or roll any single change back with one click.

Autopilot Mode

A scheduled scan's near-zero-false-positive findings get an independent AI check before anything is touched — only a confirmed verdict leads to a (still fully restorable) removal.

Fleet Dashboard & bulk actions

Monitor every licensed site's scan status from one place, and trigger a remote re-scan or push a hardening config change across every site instead of logging into each one individually.

Pro also adds instant Slack/Discord/Telegram alerts, one-click branded security reports, a self-testing/auto-rollback password gate in front of /administrator, and priority support with a tracked ticket instead of a public queue.

Security Model

→ No separate secret key, login screen, or public-facing URL — access is entirely governed by Joomla's own authentication and ACL.
→ Only users with the com_muruguard permission (Super Users by default) can view results or trigger actions.
→ Every state-changing action requires a Joomla CSRF token, same as core Joomla components.
→ No file content is ever executed or included — only read as text for pattern matching.
→ The companion plugin has no settings of its own, wraps every check in a try/catch, and fails open if the component isn't installed or a check throws.

Quick reference

Install com_muruguard, then plg_muruguardshield, via System → Install → Extensions.
Run your first scan under Components → MuRu Guard → Scan.
Enable the Shield plugin, then turn on Protection Mode from Settings.
Turn on Admin Lockdown and Protected User Snapshot if you manage the site with multiple admin accounts.
Set up scheduled scanning with a webcron URL so you're alerted the moment something new appears.
Upgrade to Pro for File Integrity Monitoring, the WAF, the Smart AI Assistant, and Fleet Dashboard if you manage more than one site.

Get MuRu Guard

Download the free edition, or see what Pro adds and current pricing on the product page.

View Product Page See Pricing

MuRu Guard: The Free, Always-On Security Scanner for Joomla — and What Pro Adds

Comments (0)