Overview & Setup

On-demand scanning finds problems after they happen. Site Protection, powered by the MuRu Guard Shield plugin, checks incoming requests as they reach Joomla and records matches in the Protection Log.

Site Protection Overview

Watch the video below for a walkthrough of the MuRu Guard Site Protection settings and available protection controls.

Enabling Site Protection

Make sure the MuRu Guard Shield Plugin is installed and enabled under System > Manage > Plugins, then open Muru Guard > MuRu Settings > Site Protection.

Blocking is off by default. Enable the individual protection switches you want to actively reject requests. Detection and logging can continue even when active blocking is disabled.

Request Blocking

Request Blocking controls what the Shield can refuse before Joomla processes the request, including malicious patterns, scanner user-agents, countries, referrer spam, dangerous uploads, Spamhaus-listed IPs, repeat offenders, and the Web Application Firewall.

• Actively Block High-Confidence Attack Patterns — rejects high-confidence attack matches with HTTP 403 instead of only logging them. Lower-confidence matches remain log-only regardless of this setting.
• Block Virtual-Patch (CVE) Matches — rejects requests matching a published per-CVE virtual patch with HTTP 403. Matches are logged whether blocking is enabled or not, and expired rules never block.
• Block Known Scanner/Bot User Agents — rejects requests whose User-Agent matches a known vulnerability-scanning tool such as sqlmap, Nikto, or Acunetix.
• Block by Country — rejects requests originating from selected countries using a cached IP-to-country lookup. If the lookup service is unavailable, the request is allowed through. Logged-in administrator sessions are never affected.
• Blocked Country Codes — specify comma-separated two-letter ISO country codes, such as CN,RU,KP. This setting applies only when country blocking is enabled.
• Block Spam Referrers — rejects requests whose Referer header matches known referrer-spam or crawler-noise domains using MuRu Guard's curated list.
• Block Dangerous File Uploads at Upload Time — rejects dangerous or disguised executable filenames before they are written to disk, including patterns such as shell.php and shell.php.jpg.
• Block IPs on the Spamhaus Public Blocklist — rejects requests from IP addresses currently listed on Spamhaus ZEN. Results are cached per IP, and lookup failures never cause a request to be blocked.
• Auto-Block Repeat Offenders — automatically adds an IP to the IP Access List after it has been blocked repeatedly within the configured window. Once added, subsequent requests are rejected immediately.
• Active Web Application Firewall — blocks generic SQL injection, XSS, local/remote file inclusion, and command-injection patterns in incoming requests. These checks run after the more specific protection checks so a request is not unnecessarily evaluated twice.

Login Protection

Login Protection controls administrator access with brute-force protection, a configurable secret administrator URL, and alerts for privileged logins from previously unseen locations.

• Secret Administrator URL — protects the Joomla /administrator area behind a configurable secret URL. Requests without the secret receive a plain 404 response.
• Secret URL Recovery — if access is lost, create ADMIN-SECRET-BYPASS.txt in administrator/components/com_muruguard/helpers/data/ through FTP or your hosting panel to reopen the backend. Rotate the secret and remove the bypass file after recovery.
• Block Brute-Force Login Attempts — rejects further backend login attempts from an IP after it exceeds the configured failed-login threshold within the selected time window. Every failed attempt is logged regardless of this setting.
• Privileged Login Alerts — emails the configured alert address when a Super User, Administrator, or Manager logs in from a previously unseen IP address or country. This feature alerts only and never blocks the login.

Additional Hardening

• Remove Joomla Generator Meta Tag — removes the Joomla generator meta tag from rendered pages to reduce unnecessary platform fingerprinting.
• Automatic tmp/ Folder Cleanup — during scheduled checks, removes files older than 24 hours from Joomla's tmp/ directory. Folders are never removed.
• Homepage Watch — monitors the live homepage during scheduled checks for downtime, recovery, defacement, SEO-spam injection, and TLS certificates approaching their 14-day expiry window. Email alerts are sent only when a monitored state changes.
• Reputation & Blocklist Watch — checks the site's URL against Google Safe Browsing and performs a Spamhaus ZEN self-check. Email alerts are sent only when the status changes between listed and cleared.
• Weekly Security Digest Email — sends a compact security summary containing scan counts, Shield blocks, watch states, file integrity status, VEL matches, and backup freshness. The digest also acts as a useful cron and email delivery heartbeat.
• Admin Lockdown — blocks the Joomla extension installer and creation of new backend users while enabled, helping prevent a compromised administrator session from installing a malicious extension or creating a new privileged account. Joomla core updates and editing existing users remain available.
• Protected User Snapshot & Auto-Revert — snapshots current Super Users and checks them during scheduled scans. A protected account that is blocked or removed from the Super User group can be automatically restored. Email/password changes and account deletions generate alerts but are not automatically reverted.
• Hygiene Dormant Threshold — flags privileged accounts that have not logged in for the configured number of days. Accounts that have never logged in are always flagged. Set the threshold to 0 to disable the age check.
• Remind Privileged Accounts Without Two-Factor Authentication — displays a once-per-session administrator banner with an MFA enrollment link for privileged accounts without a configured MFA method. This reminder does not block access.
• Refuse Privileged Logins Without Two-Factor Authentication — after a 7-day grace period, refuses backend logins for privileged accounts without MFA. Frontend logins are not affected.
• MFA Recovery — if privileged access is blocked by MFA enforcement, create MFA-ENFORCE-BYPASS.txt in the MuRu Guard data directory through FTP to recover access.

Honeypot Canaries

Honeypot Canaries provide tripwires for suspicious activity that may not match a known attack signature.

• File Canary — plants a self-reporting decoy file in the images/ directory that legitimate site activity should never execute.
• Decoy Super User — creates a blocked decoy administrator account that legitimate users should never access.
• Email Alerts — when a canary is triggered, the event is detected during the next scheduled check and an email alert is sent.
• Opt-In Deployment — canaries are planted manually and do not require a separate monitoring switch.

Backend Access Hardening

MuRu Shield Hardening adds an additional web-server password prompt in front of /administrator, blocking brute-force attempts before Joomla itself loads.

The protection is automatically verified with a real test request and rolled back if verification fails, preventing an untested configuration from locking you out of the Joomla backend.