Lyzerslab
← Back to MuRu Guard docs

Core Features

Detection Details

Last updated: October 31, 2026

  • Quarantine (Pro) — a reversible alternative to Delete; quarantined files are renamed so the web server can never execute them, backed by an .htaccess deny rule, with one-click Restore and permanent Delete from a recorded manifest.
  • Secret Administrator URL (Pro) — hides /administrator behind a secret address; strangers receive a brand-free 404, expired sessions fall through to Joomla's normal login via a signed marker cookie, and a recovery bypass file can be created to prevent accidental lockouts.
  • Virtual Patching for Fresh CVEs (Pro) — narrow per-CVE firewall rules, using a named component, named parameter, tight regex, and expiry, block the exploit request itself between disclosure and your update window. Every blocked request is logged, and protection is active only when the Pro toggle is enabled.
  • Live VEL Cross-Check (Pro) — installed extensions are matched against Joomla's official Vulnerable Extensions List, refreshed every 24 hours and checked independently of Muru Guard's built-in update audit. Extensions are flagged as VULNERABLE or Verify, with a link to the relevant listing; unparseable entries fall back to Verify, never Clean.
  • Test a Request — a read-only simulator showing exactly what Shield would do with a given URL, IP, User-Agent, or Referer — blocked, flagged, or allowed — and why, before you enable any blocking switch.
  • Admin Lockdown & Protected Users — blocks the extension installer and new backend-user creation while enabled; snapshots every Super User and automatically reverts a blocked or demoted account, while email/password changes and deletions trigger an immediate alert.
  • Honeypot Canaries (Pro) — a self-tripping decoy file and decoy Super User that legitimate traffic should never touch; the scheduled check emails you when a canary is triggered. Planting the canaries is opt-in, with no separate monitoring toggle required.
  • Privileged 2FA Enforcement (Pro) — Super Users and Administrators without multi-factor login receive a reminder banner first, then are signed out until they enroll after a 7-day grace period, with an emergency bypass file for lockout recovery.
  • Custom Signatures (Pro) — define your own PCRE content signatures to check against scanned files alongside the built-in signature set, with validation guards that refuse invalid patterns or signatures matching benign text instead of flagging the whole site.
  • Search Code by Snippet (Pro) — paste any code fragment to find every file containing it, with line numbers and previews. Supports Literal and Regex modes with a per-area scope selector and remains strictly read-only.
  • "I'm Hacked" Incident-Response Mode (Pro) — a guided lockdown checklist with step tracking that walks you from containment to recovery when a compromise is confirmed, bringing the security and audit tools together in one workflow.
  • Update Audit Card (Pro) — provides PHP security-support dates, checks installed SP Page Builder and JCE versions against known-vulnerable version floors, and identifies outdated extensions using Joomla's own update cache, with a link to the updater.
  • Findings Export (Pro) — download exactly the finding set displayed in the results as CSV or JSON for tickets and client reports. Raw matched-code snippets are stripped by default so payload bytes do not leave the site accidentally.
  • Known-Malware Hash Matching — performs an exact SHA-256 comparison against confirmed malicious samples. A byte-for-byte match is proof, not a heuristic guess, and convicted files skip straight past review.
  • Reputation & Blocklist Watch (Pro) — scheduled Google Safe Browsing and Spamhaus ZEN self-checks that send email notifications only when the status changes, such as a new listing or recovery. Recovery requires two consecutive confirmations so a temporary lookup failure does not trigger a false recovery notification.
New in v5.1.0
  • Firewall Rate Limiting (Pro) — temporarily blocks an IP that floods the site (default 120 requests a minute, blocked for 10 minutes); the backend and allow-listed IPs are never limited.
  • HTTP Method and Empty User-Agent Rules (Pro) — optionally refuse TRACE, TRACK, CONNECT and unknown request methods, and requests that send no User-Agent at all.
  • Database Privilege Audit (Pro) — reads your database grants and flags FILE, SUPER, CREATE USER, RELOAD, SHUTDOWN, PROCESS and GRANT OPTION, with the exact REVOKE statement for each. Report only.
  • Joomla Action Log Review (Pro) — the security-relevant slice of Joomla's own User Actions Log (extension installs, user and group changes, configuration, template and module saves) for 24 hours, 7 or 30 days, with a scheduled email for new installs and privilege changes.
  • Update Source Integrity Watch (Pro) — flags plain-HTTP update sources and emails you when an update source is added, removed or has its address changed.
  • Mail Authentication Audit (Pro) — checks SPF, DMARC and DKIM for your mail sender domain with fix guidance, using read-only DNS lookups cached for an hour.
  • Runtime Header Probes (Pro) — live verification now also checks clickjacking protection, Referrer-Policy, backend-page headers and server version disclosure; Content-Security-Policy is shown as advisory only.
  • Live "Found So Far" Indicator — the scan overlay shows a pulsing red dot and a running count as soon as a scan finds something suspicious.
  • New Malware Filenames — the scanner now flags x-kay.php.json and kepalabapakkau.php.json (and bare .php / .inc drops of the same names) from the Helix3 campaign.
New in v5.2.0
  • Threat Monitor — charts of attacks over time, top rules and attack types, a Low-to-Critical threat level, the last five scans and the latest Joomla security announcements. 24 hour and 7 day views for everyone; 30 and 90 day views, countries, filters and CSV export (Pro).
  • Recent Events (replaces the Protection Log) — one filterable event list with paging, CSV export and a timed Block / Safe button on every row (Pro); Free shows the latest 50 events and can still block an IP.
  • A to F Security Grade and PHP Version Banner — a letter next to the score, a "clean and protected" banner that only appears when it is true, and a red banner when PHP is missing security releases (amber when its branch is past security support).
  • Upload Lockdown — an emergency brake: one managed .htaccess rule refuses every file upload for 1 to 72 hours, with the backend spared by default, a verified test upload, automatic rollback and a dashboard banner while it is on.
  • PHP-in-Uploads Protection Watch (Pro) — alerts when the rule that blocks PHP in upload folders is removed or stops working, verifies media, images, uploads, tmp, cache and files separately, and re-applies the rule in one click.
  • Impostor Search-Bot Blocking (Pro) — a request claiming to be Googlebot, Bingbot, Yandex, Baidu or Applebot is checked against reverse DNS and refused when it is an impostor; a failed lookup never blocks.
  • Firewall Exceptions (Pro) — page paths that legitimately post code can skip the pattern, virtual-patch and WAF filters; IP, country, brute-force and rate-limit checks still apply.
  • PHP Configuration Audit (Pro) — grades allow_url_include, display_errors, expose_php, disable_functions, open_basedir and the session cookie settings, and says where to change each.
  • Backup Freshness Check (Pro) — reads Akeeba Backup's records and warns when the newest successful backup is older than your limit or the last run failed; a stale backup lowers the score.
  • Weak Administrator Password Check (Pro) — tests Super User, Administrator and Manager passwords against a short list of very common ones on your own server; only a yes or no per account is kept.
  • Alert Rules and Client Report (Pro) — alert on High findings only, switch watches off, set quiet hours (held alerts go out as one email), and send a weekly or monthly client report.