Muru Guard — Latest Fixes & Additions

The following security improvements and new features are now available in Muru Guard Pro, unless otherwise noted.

Live VEL Cross-Check — Pro

Every installed extension is now checked against Joomla's official Vulnerable Extensions List (VEL). The list is refreshed every 24 hours and checked independently of Muru Guard's built-in update audit.

Extensions are clearly flagged as Vulnerable or Verify, with a direct link to the relevant VEL listing.

The check is available as a read-only card under Settings → Analysis. If a listing cannot be parsed or verified, Muru Guard reports Verify rather than incorrectly marking it as clean.

Virtual Patching for Fresh CVEs — Pro

Muru Guard can now provide temporary protection between a CVE disclosure and the availability or installation of an official update.

Each virtual patch uses a narrow, per-CVE firewall rule targeting the affected component, parameter, and request pattern. Rules automatically expire when appropriate and are evaluated before generic pattern matching.

Every blocked request is logged, and protection is activated only when the Pro feature is enabled.

Test-a-Request lets you preview exactly what a virtual patch would match.

Virtual-patch rules are curated through the Muru Guard security feed.

Global Configuration Security Audit — Pro

Muru Guard now performs 17 read-only security checks covering Joomla hardening settings that traditional security scans may not detect.

Checks include:

• Debug and error output
• Error verbosity
• Session handling
• Cookie security flags
• Forced HTTPS
• FTP layer configuration
• Web Services
• MFA availability
• And more

Each finding includes a direct link to the Joomla configuration area where the setting can be changed.

Available under Settings → Analysis.

Secret Administrator URL — Pro

Protect the Joomla /administrator area with a configurable secret administrator URL.

When enabled:

• Unauthorized visitors receive a brand-free 404 response.
• Expired sessions can fall back to Joomla's normal login using an HMAC-signed marker cookie.
• A recovery bypass file can be generated if access is accidentally lost.
• A reminder banner helps prevent administrator lockouts.
• A live URL preview makes configuration easy.

The feature is available under Site Protection.

Privileged 2FA Enforcement — Pro

Muru Guard now helps enforce multi-factor authentication for Super Users and Administrators.

Users without MFA receive a reminder banner first. After a 7-day grace period, they are signed out until MFA enrollment is completed.

Emergency recovery is supported through a bypass file. Imported accounts without an existing grace-period record receive a reminder rather than being immediately blocked.

Sensitive-File Exposure Probes & One-Click Deny — Pro

The runtime-verification modal now includes three additional live probes for detecting whether configuration backups and other sensitive files are publicly accessible over HTTP.

When exposure is detected, Muru Guard can install a managed and self-tested .htaccess deny rule with one click.

The original configuration is backed up in the protected data directory, and rollback is supported.

An equivalent nginx configuration snippet is also provided.

Honeypot Canaries — Pro

Muru Guard can now deploy security canaries designed to detect suspicious activity.

The feature includes:

• A decoy file in the images/ directory
• A blocked decoy Super User
• Automatic detection when a canary is accessed
• Email notification when a canary is triggered

Planting the canaries is opt-in. No separate monitoring toggle is required.

Reputation & Blocklist Monitoring — Pro

Scheduled self-checks against Google Safe Browsing and Spamhaus ZEN can now monitor the site's reputation.

Muru Guard sends email notifications only when the status changes, such as:

• A site becomes newly listed
• A previous listing is cleared

Recovery requires two consecutive confirmations, preventing a temporary lookup failure from generating a false recovery notification.

Weekly Security Digest — Pro

Receive a plain-text security digest every six days.

When everything is quiet, the email reports:

ALL-CLEAR

When attention is required, it reports:

NEEDS-REVIEW

The digest summarizes eight key security signals.

A missing digest can also serve as a useful operational signal: it may indicate that cron or outbound email delivery needs attention.

Slimmer Security Score

The dashboard Security Score has been redesigned into a compact strip containing:

• Security score badge
• Current status
• Issue count

Instead of displaying every issue in a large card, the complete issue list now expands on demand in a compact two-column layout.

Companion Shield 2.0.0

Muru Guard Shield 2.0.0 is the companion system plugin responsible for enforcing the new protection features at request time.

The update includes:

• Virtual-patch request matching
• Secret administrator URL protection
• HMAC marker-cookie handling
• Privileged 2FA reminder and enforcement hooks

Important: Update the Shield plugin together with the Muru Guard component to ensure all new protection features work correctly.