Lyzerslab
← Back to MuRu Guard docs

Core Features

Feature Overview

Last updated: October 30, 2026

Watch the MuRu Guard Security Scanner overview:


Detect

  • Filesystem Scan — scans media, images, templates, tmp, cache, component directories, api, includes, language and the webroot, including configuration.php, .htaccess and .user.ini; cross-references Joomla's own extension registry so faked manifests and orphaned folders cannot hide.
  • Core Integrity — detects prepended payloads that run before Joomla's bootstrap in entry points, and byte-verifies supported core files against bundled SHA-256 hashes from official Joomla releases.
  • Database Scan — finds Helix Ultimate mega-menu XSS payloads, template Custom JS/CSS injections, SP Page Builder asset-table injections, rogue iconfont rows and template defacement strings, with surgical one-click cleaning that preserves legitimate settings.
  • Rogue account and signature checks — flags attacker-pattern Super Users, webshell families, obfuscated eval/base64 code and stream-wrapper abuse, with a known-bad file hash list.
  • Vulnerable extensions — matches installed extensions against a curated advisory feed (Free) and Joomla's official Vulnerable Extensions List with a live cross-check (Pro), without blaming Joomla's own plugins or newer versions.
  • Homepage watch — checks the live homepage on every scheduled check and emails you only when it changes: site down, defaced or filled with SEO spam.
  • Search code by snippet (Pro) — paste an indicator and find every file that contains it, literally or as a regular expression.

Block

  • Protection Mode — a companion plugin inspects every site request in real time; manual IP allow/block lists with IPv4 and IPv6 CIDR support and temporary auto-blocking, country blocking, bad user-agent and referrer-spam blocking, and brute-force login protection.
  • Active Web Application Firewall (Pro) — blocks generic SQL injection, cross-site scripting, local/remote file inclusion and command-injection patterns in real time, before they reach your extensions.
  • Virtual patching (Pro) — narrow per-CVE rules block the exploit request itself while you wait for the vendor's update.
  • Firewall rules (Pro) — per-IP rate limiting, HTTP method restriction, empty User-Agent blocking, impostor search-bot blocking (fake Googlebot, Bingbot and more, checked by reverse DNS) and firewall exceptions for pages that legitimately post code.
  • Upload lockdown — an emergency brake that refuses every file upload for 1 to 72 hours, with the backend spared by default, a verified self-test and automatic switch-off.
  • Emergency Mode, Admin Lockdown and backend password gate — lock the whole site behind a password, block the extension installer, Joomla Update uploads, template file editing and new users, and put an HTTP Basic Auth gate in front of /administrator, each verified with a real request and rolled back if it fails.
  • Secret administrator URL and honeypot canaries (Pro) — hide the login behind an address only you know, and plant a decoy file and a decoy Super User that only an attacker would touch.

Monitor

  • Threat Monitor — charts of attacks over time, top rules and attack types, a Low-to-Critical threat level and a filterable event log (24 hour and 7 day views for everyone; 30 and 90 day views, countries, filters, CSV export and per-row blocking with Pro), plus the latest Joomla security announcements.
  • Security score with an A to F grade — one score with the reasons behind it, a "clean and protected" banner that only appears when it is true, and a red or amber banner when your PHP is missing security releases or past its security support.
  • File Integrity Monitoring (Pro) — baseline-hashes every file once, then flags anything that silently changes afterwards, a tamper tripwire between scheduled scans.
  • PHP-in-uploads protection watch (Pro) — alerts when the rule that blocks PHP in upload folders is removed or stops working, verifies each folder on its own and re-applies the rule in one click.
  • Reputation and blocklist watch (Pro) — Google Safe Browsing and Spamhaus self-checks that email you only when your status changes.

Audit and harden

  • .htaccess Hardening Advisor — audits PHP-execution blocking in upload folders, security headers and other hardening gaps, with one-click apply including backup and self-test, plus a ready-to-use configuration snippet for nginx servers.
  • Configuration and server audits (Pro) — Global Configuration (17 checks), PHP configuration, database privileges, mail authentication (SPF, DMARC, DKIM), update sources, Joomla Action Log review, account hygiene, scheduled tasks and live runtime verification.
  • Backup freshness and weak password checks (Pro) — warns when your newest Akeeba backup is too old or failed, and tests privileged accounts against very common passwords on your own server, keeping only a yes or no.
  • Update audit (Pro) — PHP and Joomla versions against their support dates, SP Page Builder and JCE status, and outdated extensions, read-only.

Clean up and recover

  • Guided cleanup — scoped delete, menu and template cleanup and rogue SP Page Builder row removal, with protected folders that can never be touched.
  • Smart False-Positive Handling — dismiss any finding with one click. The dismissal is fingerprint-bound to the exact content you reviewed, so a genuinely new problem in the same file can still reappear.
  • Quarantine and "I'm hacked" mode (Pro) — quarantine renames a file so it cannot run and restores it in one click; one-click containment snapshots the Super Users, locks the installer and signs out everyone else, with an 8-step recovery checklist.
  • Backup & Restore (Pro) — every AI repair and cleanup action automatically saves a SHA-256-verified snapshot first. Restore in one click per file, per database row or for an entire multi-file request; rollback refuses to overwrite a file that has changed since the snapshot.

Automate and report

  • Automations & Alerts (Pro) — scheduled webcron scans with new-findings-only email alerts, alert rules and quiet hours, Slack, Discord and Telegram notifications, a weekly all-clear digest, Fleet Dashboard reporting and a branded shareable Security Report.
  • Scheduled client report (Pro) — a weekly or monthly email with the score and its change, findings opened and closed, attacks blocked, backup, certificate and Joomla status.
  • Autopilot Mode (Pro) — removes near-zero-false-positive threats on a schedule, AI-verified and restorable. Off by default.
  • Smart AI Assistant (Pro) — chat with an assistant that can list, search and read project files and, only with your explicit confirmation, edit them; the server runs exactly the change you approved, and only for Super Users. Every action is recorded in a permanent audit log.