Muru guard core detection engines

Quarantine (Pro) — a reversible alternative to Delete; quarantined files are renamed so the web server can never execute them, backed by an .htaccess deny rule, with one-click Restore and permanent Delete from a recorded manifest.
Secret Administrator URL (Pro) — hides /administrator behind a secret address; strangers receive a brand-free 404, expired sessions fall through to Joomla's normal login via a signed marker cookie, and a recovery bypass file can be created to prevent accidental lockouts.
Virtual Patching for Fresh CVEs (Pro) — narrow per-CVE firewall rules, using a named component, named parameter, tight regex, and expiry, block the exploit request itself between disclosure and your update window. Every blocked request is logged, and protection is active only when the Pro toggle is enabled.
Live VEL Cross-Check (Pro) — installed extensions are matched against Joomla's official Vulnerable Extensions List, refreshed every 24 hours and checked independently of Muru Guard's built-in update audit. Extensions are flagged as VULNERABLE or Verify, with a link to the relevant listing; unparseable entries fall back to Verify, never Clean.
Test a Request — a read-only simulator showing exactly what Shield would do with a given URL, IP, User-Agent, or Referer — blocked, flagged, or allowed — and why, before you enable any blocking switch.
Admin Lockdown & Protected Users — blocks the extension installer and new backend-user creation while enabled; snapshots every Super User and automatically reverts a blocked or demoted account, while email/password changes and deletions trigger an immediate alert.
Honeypot Canaries (Pro) — a self-tripping decoy file and decoy Super User that legitimate traffic should never touch; the scheduled check emails you when a canary is triggered. Planting the canaries is opt-in, with no separate monitoring toggle required.
Privileged 2FA Enforcement (Pro) — Super Users and Administrators without multi-factor login receive a reminder banner first, then are signed out until they enroll after a 7-day grace period, with an emergency bypass file for lockout recovery.
Custom Signatures (Pro) — define your own PCRE content signatures to check against scanned files alongside the built-in signature set, with validation guards that refuse invalid patterns or signatures matching benign text instead of flagging the whole site.
Search Code by Snippet (Pro) — paste any code fragment to find every file containing it, with line numbers and previews. Supports Literal and Regex modes with a per-area scope selector and remains strictly read-only.
"I'm Hacked" Incident-Response Mode (Pro) — a guided lockdown checklist with step tracking that walks you from containment to recovery when a compromise is confirmed, bringing the security and audit tools together in one workflow.
Update Audit Card (Pro) — provides PHP security-support dates, checks installed SP Page Builder and JCE versions against known-vulnerable version floors, and identifies outdated extensions using Joomla's own update cache, with a link to the updater.
Findings Export (Pro) — download exactly the finding set displayed in the results as CSV or JSON for tickets and client reports. Raw matched-code snippets are stripped by default so payload bytes do not leave the site accidentally.
Known-Malware Hash Matching — performs an exact SHA-256 comparison against confirmed malicious samples. A byte-for-byte match is proof, not a heuristic guess, and convicted files skip straight past review.
Reputation & Blocklist Watch (Pro) — scheduled Google Safe Browsing and Spamhaus ZEN self-checks that send email notifications only when the status changes, such as a new listing or recovery. Recovery requires two consecutive confirmations so a temporary lookup failure does not trigger a false recovery notification.

Detection Details