Runtime hardening verification

An .htaccess rule sitting in a file means nothing if a CDN strips the header, nginx ignores the file, or the rule never matched. Runtime verification (Pro) probes the live server and reports what is actually enforced, with fix guidance for each gap. Run it from the Verify now button; results persist so the card shows the last verdicts until you re-run.

The probes

• X-Content-Type-Options: nosniff — the live homepage response actually carries it.
• Permissions-Policy — the live homepage response actually carries one.
• Generator tag absent — rendered homepage HTML contains no Joomla generator meta tag.
• PHP refused inside media/ — requesting a nonexistent .php URL there returns 403. A 404 instead means no blocking rule answered.
• No directory listing under media/ — browsing the folder is refused rather than rendering an "Index of" listing.
• configuration.php not served — requesting it directly is refused. A 200 means the file is web-readable: rotate every credential it holds and block it.
• Strict-Transport-Security — checked on HTTPS sites only; the live response must carry an HSTS header.

Joomla 3

Identical on the Joomla 3 edition (v2.3.0): same probes, same stored verdicts, same Pro gate.