Active Web Application Firewall

Protection Mode's own signatures are deliberately narrow -- webshell interaction, SP Page Builder's own RCE, known drop filenames. The Web Application Firewall adds a second, broader pass: generic injection-class patterns any Joomla site is exposed to, regardless of which extensions it runs.

Coverage

• SQL Injection -- UNION SELECT, boolean-tautology, and time-based blind injection.
• Cross-Site Scripting -- inline <script> tags and event-handler attributes in request parameters.
• Local & Remote File Inclusion -- PHP stream wrappers and remote-URL include/require attempts.
• Command Injection -- shell metacharacters chained with a recognized command.
• Known-CVE coverage -- includes a signature for Joomla's CVE-2023-23752 unauthenticated webservices probe.

The WAF only runs when Protection Mode's own signatures find nothing on that same request, so a request is never scored twice. Broad, proximity-based matches log for review instead of blocking, so a false positive never reaches the blocking path.