What's New

5.4.0

Released 2 November 2026. A Pro feature release: live protection against attacks as they happen, new checks that find hidden spam, skimmers and abandoned extensions, a quick scan for large sites, and one-click core file repair. Update the Shield plugin to 2.4.0 together with the component. Every new live-protection switch is off until you turn it on in Options > Protection. Bullets marked (Pro) need an active license; everything else is in Free.

New

• Last scheduled scan on the Dashboard (Pro). When there are no fresh results, the Run Scan screen shows when the scheduled scan last ran and what it found, with a button that shows those results without running a new scan.
• Hidden spam and redirect check (Pro). Settings > Analysis opens your homepage, menu items and newest articles as a browser, Googlebot, a phone and a visitor from Google, and reports spam or redirects that only some of them get; the scheduled check repeats it and alerts on changes.
• Compare with the original zip (Pro). Upload an extension's or template's original installation zip and see which installed files were changed, added or removed; the zip is only read, never installed or kept.
• Quick scan (Pro). A scan can read only new and changed files (upload folders always in full), and the scheduled check can too, while a full scan still runs every 7 days and after every rules update.
• Login skimmer watch (Pro). The login, registration and password-reset pages are watched for new scripts, page code or forms that talk to another site, with one alert per new host and an Accept as normal button.
• Monitor-only period for new rules (Pro). A blocking rule that arrives later, such as a new virtual patch, first only logs what it would have blocked for 48 hours (adjustable), and Site Protection lists these rules with Block now and +24 hours buttons.
• Abandoned extensions (Pro). Settings > Analysis lists third-party extensions that have had no release or update for 2 years with no newer version offered, and the scheduled check alerts once per extension version.
• Core file repair (Pro). Joomla's entry points and protection files are compared with the official release, and a changed or missing one can be put back with one click from the official Joomla copy, checked against the bundled checksum, with the old copy kept in Quarantine.
• Ready for the next Joomla version (Pro). A checklist before a major upgrade: a recent clean scan, a fresh backup, no abandoned extensions, a PHP version the next major supports, and a test without the backward-compatibility layer.
• Webshell drop catcher (Pro). When a visitor's request leaves a new PHP file in images, media, tmp, files or uploads, Protection Mode moves it to quarantine, blocks the IP for 7 days, logs a Critical event and sends an alert.
• Attack-tool probing block (Pro). A visitor that asks for paths only attack tools ask for (.env, .git, wp-login.php and similar), or for 30 missing pages in 10 minutes, is blocked for 24 hours.
• Password-reset and registration flood limits (Pro). One IP can request 5 password resets and 3 registrations an hour, and a username attacked from 5 or more IPs at once cools down for 15 minutes.
• Under-attack mode (Pro). When blocked requests jump far above the site's normal level, MuRu Guard locks the installer and new backend users, lowers the failed-login limit to 3 and stops visitor uploads and com_ajax posts for 2 hours, then sends an alert.
• Spam-mail flood guard (Pro). When the mails Joomla sends from its own forms jump far above normal (or above a set hourly limit), front-end mail is paused until an administrator resumes it, with one alert; mail sent directly with PHP's mail() is not seen.
• Stolen-session protection (Pro). An administrator session used from a different browser, or in strict mode a different network, is signed out, logged and reported by e-mail.
• Password confirmation for dangerous actions (Pro). Installing extensions, uploading a Joomla update, saving Global Configuration, saving users and changing template files ask for the password again when it was not entered in the last 15 minutes.

Changed

• The scan screen shows findings as they are found. While a scan runs you see each suspicious file with its confidence and reason, a progress bar that follows the scanned areas, the time so far and a Stop scan button, with updates every few seconds.

Fixed

• The Run Scan screen comes back after the results expire (Pro). Opening the Dashboard no longer starts a full scan in the background, so results stay for 5 minutes after your last action and then the Run Scan screen returns, and the Dashboard opens faster.

Security

• An expired license stops at its end date (Pro). A license past its expiry date switches Pro off at once, even before the hourly check and even when the license server cannot be reached; the 7-day allowance for an unreachable server no longer runs past the expiry date.