MuRu Compliance Auditor

MuRu Compliance Auditor installs like any Joomla extension and runs entirely inside the administrator, behind Joomla's own authentication and ACL. It discovers your pages from menus, categories and the sitemap, fetches each one with a same-origin, SSRF-safe crawler, and evaluates it against a pluggable set of WCAG 2.2 checks.

Every finding names the exact element, the success criterion it fails (WCAG 2.2 and EN 301 549), and how to fix it in Joomla. Scan results are scored, tracked over time, and — on Pro — rendered into a tamper-evident audit report and a ready-to-publish Accessibility Statement.

Part of the MuRu family alongside MuRu Guard Security Scanner.

Everything you need to find and fix accessibility problems on a single site, run on demand.

Free is genuinely complete for a single site run on demand. Pro is for teams that must stay compliant across many sites and prove it on request.

Free and Pro are the same product, different builds — Pro code is simply absent from the Free package. Everything is GPL-2.0-or-later.

New Lyzerslab accounts get Pro free for three months, no payment required. After that:

Scheduled scanning, alert channels, PDF/VPAT reports, the rendered deep scan, the privacy audit, the fleet dashboard and CI endpoints are Pro features and unlock with an active licence. The full Free edition keeps working if a licence lapses.

Each check is a small, single-purpose rule that maps to a WCAG 2.2 success criterion and its EN 301 549 clause, and carries Joomla-specific remediation copy.

Accessibility drifts every time an editor uploads a PDF, pastes a table, or adds an image without a description. The linter moves the check left: an editor button runs an on-demand review of the current article, and a save-time hook warns when a change introduces a new violation.

On Pro, a policy can escalate specific categories or severities to block-on-save, and rules can be tuned per author or per category.

"Show us what you've done, and when." That is the question from a regulator, an insurer, a procurement officer or a plaintiff's lawyer — and a screenshot does not answer it.

Generates a statement following the EU model structure — standard applied, conformance status, known non-accessible content and why, the feedback mechanism, the enforcement contact, and the preparation date and method — ready to publish as a Joomla menu item.

Free ships one template for the current site. Pro adds custom fields, multi-site statements, an auto-refreshed conformance status tied to your latest scan, and a hosted verification URL.

Reporting only — it never blocks or rewrites anything. The Joomla cookie-consent space is already crowded; the unsolved part is knowing whether what actually fires matches what you declared.

• Inventory of third-party trackers present on each page
• Detection of tags loading before a consent signal
• Diff of new cookies since the last scan (stale declaration catch)
• GDPR opt-in vs CCPA "Do Not Sell" guidance by visitor region
• Google Consent Mode v2 signal-presence check
• Right-to-be-forgotten helper: locate a person's data across core and registered third-party tables

One licence covers every client site. The fleet dashboard shows each site's score and open findings in a single view, lets you trigger a remote re-scan or push a scan profile across the fleet, and bundles per-client report packs. It is the basis for a productised "compliance monitoring" retainer.

A Joomla console command and read-only REST endpoints let a pipeline run a scan and fail a build when the score drops below a threshold. Findings export as SARIF for code-scanning UIs, or JSON and CSV for anything else.

php cli/joomla.php muruaudit:scan --profile=wcag22-aa --fail-under=90 --format=sarif

1. 1

   Install the package

   Upload pkg_muruaudit from System > Install Extensions. One package installs the component, the system and quick-icon plugins, and (Pro) the scheduled-scan and CI plugins plus the dashboard module.

2. 2

   Set permissions

   By default only Super Users get access. Grant Scan, Configure, Export or Manage-Statement permissions to trusted groups through Joomla's own Access Levels.

3. 3

   Run a scan

   Open Components > MuRu Compliance Auditor > Dashboard, pick a profile, and review findings grouped by success criterion and page.

4. 4

   Publish the statement

   Generate an Accessibility Statement and link it from a menu item.

5. 5

   Schedule monitoring

   On Pro, enable a scheduled task in Joomla's Scheduler and bind an alert channel (email, Slack, Discord, Telegram or webhook).

6. 6

   Activate your licence

   Paste your key into Settings > Licence to unlock PDF/VPAT reports, the rendered deep scan, the privacy audit, the fleet dashboard and CI endpoints.

7. 7

   Stay updated

   The extension registers with Joomla's update system on both Free and Pro — new releases appear in System > Update.