MuRu Compliance Auditor

MuRu Compliance Auditor installs like any Joomla extension and runs entirely inside the administrator, behind Joomla's own authentication and ACL. It discovers your pages from menus and same-site link following, fetches each one with a same-origin, SSRF-safe crawler, and evaluates it against a pluggable set of WCAG 2.2 checks.

Every finding names the exact element, the success criterion it fails (WCAG 2.2 and EN 301 549), and how to fix it in Joomla. Scan results are scored, tracked over time, and exported as a printable HTML report with JSON/CSV — with a tamper-evident Pro audit report following in 1.2 — plus a ready-to-publish Accessibility Statement.

Part of the MuRu family alongside MuRu Guard Security Scanner.

Everything you need to find and fix accessibility problems on a single site, run on demand.

Free is genuinely complete for a single site run on demand. Pro is for teams that must stay compliant across many sites and prove it on request.

Free and Pro are the same product, different builds — Pro code is simply absent from the Free package. Everything is GPL-2.0-or-later. A “Free · From 1.x” or “Pro · From 1.x” pill marks the release an item is planned for — listed so you know what's next, not to suggest it ships today. Follow the v1.2.0 phase on the public roadmap.

Each check is a small, single-purpose rule that maps to a WCAG 2.2 success criterion and its EN 301 549 clause, and carries Joomla-specific remediation copy.

Accessibility drifts every time an editor uploads a PDF, pastes a table, or adds an image without a description. The linter moves the check left: an editor button runs an on-demand review of the current article, and a save-time hook warns when a change introduces a new violation.

On Pro, a policy can escalate specific categories or severities to block-on-save, and rules can be tuned per author or per category.

"Show us what you've done, and when." That is the question from a regulator, an insurer, a procurement officer or a plaintiff's lawyer — and a screenshot does not answer it. Today both editions ship a printable HTML report with JSON/CSV export; the dated Pro proof formats land across 1.2–1.3.

Generates a statement following the public-sector EU model structure — standard applied, conformance status, known non-accessible content and why, the feedback mechanism, the enforcement contact, and the preparation date and method — ready to publish as a Joomla menu item. An EAA-style template for private-sector conformity documentation follows in 1.2.

Free ships one template for the current site. Pro adds custom fields and an auto-refreshed conformance status tied to your latest scan (1.3), multi-site statements (2.0), and a hosted verification URL.

Reporting only — it never blocks or rewrites anything. The Joomla cookie-consent space is already crowded; the unsolved part is knowing whether what actually fires matches what you declared. A free single-signal Consent Mode teaser lands in 1.2; the full Pro audit follows across 1.3–1.4.

• Pro · From 1.3Google Consent Mode v2 signal check (all four signals)
• Pro · From 1.3Detection of tags loading before a consent signal
• Pro · From 1.4Inventory of third-party trackers present on each page
• Pro · From 1.4Diff of new cookies since the last scan (stale declaration catch)
• Pro · From 1.4GDPR opt-in vs CCPA "Do Not Sell" guidance by visitor region
• Pro · From 2.0Right-to-be-forgotten helper: locate a person's data across core and registered third-party tables

One licence will cover every client site. The fleet dashboard will show each site's score and open findings in a single view, let you trigger a remote re-scan or push a scan profile across the fleet, and bundle per-client report packs. It is the basis for a productised "compliance monitoring" retainer.

A Joomla console command and read-only REST endpoints will let a pipeline run a scan and fail a build when the score drops below a threshold. Findings export as JSON and CSV today, with SARIF for code-scanning UIs following in 2.0.

php cli/joomla.php muruaudit:scan --profile=wcag22-aa --fail-under=90 --format=sarif

1. 1

   Install the package

   Upload pkg_muruaudit from System > Install Extensions. One package installs the component and the system and quick-icon plugins; Pro-only plugins ship alongside their features across 1.2-1.4.

2. 2

   Set permissions

   By default only Super Users get access. Grant Scan, Export, Statement or Fleet permissions to trusted groups through Joomla's own Access Levels.

3. 3

   Run a scan

   Open Components > MuRu Compliance Auditor > Dashboard, pick a profile, and review findings grouped by success criterion and page.

4. 4

   Publish the statement

   Generate an Accessibility Statement and link it from a menu item.

5. 5

   Schedule monitoring

   On Pro from 1.2, enable a scheduled task in Joomla's Scheduler and bind an alert channel (email or webhook at first; Slack, Discord and Telegram follow in 1.3).

6. 6

   Activate your licence

   Paste your key into Settings > Licence to unlock each Pro feature as it ships across 1.2-2.0, starting with scheduled monitoring and PDF reports.

7. 7

   Stay updated

   The extension registers with Joomla's update system on both Free and Pro — new releases appear in System > Update.