MuRu Guard: The Free, Always-On Security Scanner for Joomla — and What Pro Adds

Most Joomla security advice is reactive: something goes wrong, you find a scanner, you clean up, you move on until the next incident. MuRu Guard is built to sit in your admin panel permanently instead — a free, always-installed component that scans on demand, watches every request in real time through its companion plugin, and locks down the exact actions attackers use to turn a single compromise into a permanent foothold. Full scanning, cleanup, and real-time Protection Mode are free forever, with no restrictions; a paid Pro layer adds file integrity monitoring, an active firewall, an AI assistant that can fix what it finds, and fleet-wide monitoring for anyone managing more than one site.

In this guide

1. What MuRu Guard actually scans for
2. Protection Mode — catching attacks in real time
3. Admin Lockdown, Protected Users & Test a Request
4. Guided cleanup, not guesswork
5. Scheduled scanning & alerts
6. Installing MuRu Guard
7. Free vs. Pro — what each level gets you
8. Security model

What MuRu Guard Actually Scans For

MuRu Guard started as a response to a real, specific attack — the SP Page Builder uploadCustomIcon unauthenticated RCE, and the JCE editor infections that followed it on the same sites. That origin still shows in how targeted its detection is, but it doesn't stop there: it also checks for the generic patterns real-world Joomla compromises share, no matter which extension let the attacker in.

Every finding is labeled High or Medium confidence, so you can triage the obvious cases first instead of reading through a wall of undifferentiated results.

Protection Mode — Catching Attacks in Real Time

On-demand scanning finds an infection after it's already happened. Protection Mode, via the companion plg_muruguardshield plugin, checks every single request to your site as it happens — the only extension type Joomla runs on every page load, before routing even happens.

Everything detected — blocked or not — appears in the Protection Log, sectioned into Attack Pattern Matches and Brute-Force Login Attempts, each row showing IP, timestamp, severity, matched rule, and whether it was actually blocked.

Admin Lockdown, Protected Users & Test a Request

Three newer additions, all off by default, aimed at a specific failure mode: a compromised admin session turning itself into a permanent foothold.

Guided Cleanup, Not Guesswork

Finding something is only half the job. When MuRu Guard flags an issue, it also gives you a safe way to act on it:

• → Scoped deletion — only files/folders flagged by the current scan run can be removed; top-level Joomla folders are hard-protected regardless.
• → Code Issues preview — before cleaning a file, see the exact bytes an auto-fix would remove (and what replaces them) before running it.
• → Surgical menu-item cleaning — strips only the known injection markers out of a menu item's params JSON, field by field, leaving every legitimate layout setting untouched.
• → Confidence-first triage — review High findings, then Medium; a core entry-point finding means the site is actively compromised right now, not just historically infected.

Scheduled Scanning & Alerts

Point any cron system at a webcron URL and get an email only when something new shows up — not on every run, and never on the very first run, which just records a baseline. Turn it on in Settings, generate a token, save, and add a job to your host's cron panel or a free external cron service:

0 3 * * * curl -fsS "https://yoursite.example/administrator/index.php?option=com_muruguard&task=scanner.scheduledcheck&token=YOUR_TOKEN" >/dev/null

This reuses the exact same detection logic as a manual scan — including core-checksum verification — it just tracks what's new between runs.

Installing MuRu Guard

Free vs. Pro — What Each Level Gets You

Scanning, cleanup, Protection Mode, Admin Lockdown, and everything above is free forever, no restrictions. Pro adds a layer on top for site owners who want more:

Pro also adds instant Slack/Discord/Telegram alerts, one-click branded security reports, a self-testing/auto-rollback password gate in front of /administrator, and priority support with a tracked ticket instead of a public queue.

Security Model

• → No separate secret key, login screen, or public-facing URL — access is entirely governed by Joomla's own authentication and ACL.
• → Only users with the com_muruguard permission (Super Users by default) can view results or trigger actions.
• → Every state-changing action requires a Joomla CSRF token, same as core Joomla components.
• → No file content is ever executed or included — only read as text for pattern matching.
• → The companion plugin has no settings of its own, wraps every check in a try/catch, and fails open if the component isn't installed or a check throws.