Know exactly what's hiding in your Joomla site.

Built from a real campaign, not a wordlist

Every SPPB/Helix signature in this scanner traces back to an actual compromise, verified against real infected sites -- not copied from a generic malware-pattern list.

Pro extends that specialization further

File Integrity Monitoring baselines your SPPB/Helix template files specifically, so a payload hand-inserted into a file you already trust doesn't need to match a known pattern to get caught. The Smart AI Assistant reads and explains findings in the context of your actual SPPB/Helix codebase, not generic PHP.

Framework-aware, not just Joomla-aware

Checks the SP Page Builder asset table, Helix Ultimate's mega-menu params, and JCE's known secondary-infection paths specifically -- the places a compromise on these frameworks actually shows up.

Still free at its core

Every signature above -- SPPB, Helix, JCE -- runs in the free edition with no restrictions. Pro adds depth (integrity monitoring, an AI assistant that knows your stack, broader request-level protection), not the framework-specific detection itself.

Secret administrator URL (Pro)

Your /administrator login hides behind a secret address only you know -- strangers get a blank 404 with no MuRu branding, while a recovery file plus automatic login-page fallback mean you can never lock yourself out. Set it in one field under Site Protection.

Live vulnerable-extension cross-check (Pro)

Every installed extension is matched against Joomla's official Vulnerable Extensions List and flagged VULNERABLE or Verify with a link to the listing -- an independent second signal beside the built-in update audit. Read-only card in the Analysis tab.

Virtual patching for fresh CVEs (Pro)

Between a CVE disclosure and your update window, narrow per-CVE firewall rules block the exploit request itself -- named component, named parameter, tight pattern, automatic expiry. Test-a-Request previews exactly what each patch would block before you trust it.

Global Configuration security audit (Pro)

17 read-only checks over the hardening settings scans cannot see: debug output, error verbosity, cookie flags, session handling, forced HTTPS, FTP layer, webservices, MFA availability, and more -- each row deep-links to where you change it in Joomla.

Privileged 2FA enforcement (Pro)

Super Users and Administrators without multi-factor login first get a nag banner, then -- after a 7-day grace -- are signed out until they enroll. A bypass file covers emergencies, and imported accounts never hard-refuse without a grace record.

Sensitive-file exposure probes + one-click deny (Pro)

Live probes confirm whether configuration backups and other sensitive files are reachable over HTTP, and one click installs a managed, self-tested .htaccess deny block (backup and rollback included) -- plus a ready snippet for nginx.

Honeypot canaries (Pro)

Plant a self-tripping decoy file and a blocked decoy Super User account: real attackers touch them, legitimate traffic never does, and the scheduled check emails you the moment one trips.

Reputation and blocklist watch (Pro)

Scheduled self-checks against Google Safe Browsing and the Spamhaus ZEN list email you only on transitions -- newly listed or recovered -- with a two-read confirmation so a single flaky lookup never pages you.

Content signatures

Detects eval/base64 payloads, cookie-gated backdoors, c99/r57/WSO-style shells, stream-wrapper loading, chr-array decoding, and script injection.

Extension registry cross-check

Cross-references Joomla's own #__extensions table to catch fake templates, modules, plugins, and components -- a harder-to-fake signal than filesystem structure alone, since an attacker can spoof a folder and its manifest but not an enabled registry row.

Filename patterns

Matches known malware-drop naming, duplicate configuration files, random numeric drop folders, and suspicious top-level webroot items.

JCE coverage

Applies tuned heuristics for its upload pipeline and editor bootstrap files -- including media/com_jce and components/com_jce.

Rogue users

Flags Super User accounts with attacker-pattern names or suspicious local email domains.

Confidence scoring

Labels findings as High or Medium so administrators can prioritize review.

Guided actions

Offers scoped delete or reversible quarantine, surgical menu params cleanup, rogue SPPB asset row deletion, custom-signature matching, and one-click false-positive dismissal for current scan findings.

Protection Mode

Master switch that detects and logs every match.

Attack Blocking

Optional 403 block for high-confidence webshell, SPPB RCE, and known drop-filename matches.

Brute-Force Blocking

Optional IP blocking after repeated failed administrator login attempts.

Manual IP Access List

Always-allow or always-block specific IPs or CIDR ranges, checked before any pattern or threshold rule -- an allow entry bypasses everything else.

Country Blocking

Reject requests from chosen countries via a free IP-to-country lookup, cached per IP so it's a one-time check, not a per-request dependency. Fails open if the lookup service is ever unreachable.

Bad User-Agent Blocking

Actively reject known scanner/bot user agents, kept as its own switch since a User-Agent string alone is easier to spoof than a real attack payload.

Admin Lockdown

Blocks the extension installer and creating new backend users while on, so a compromised admin session can't install a malicious extension or plant a fresh Super User account. Never blocks Joomla's own core updates or editing an existing user -- including your own profile.

Protected User Snapshot & Auto-Revert

Snapshots every Super User and auto-reverts a blocked or demoted account immediately. An email/password change or deletion is alerted, never silently reverted, since that could just as easily be something you did yourself.

Test a Request

Paste a URL, IP, User-Agent, or Referer and see exactly what Protection Mode would do with it -- blocked, flagged, or allowed -- before you turn any blocking switch on. Runs the same frontend checks the live gate uses (backend gates like the secret admin URL cannot be simulated from a pasted request); never affects real traffic.

SQL Injection

UNION SELECT, boolean-tautology (' OR '1'='1), and time-based blind injection (SLEEP/BENCHMARK/WAITFOR DELAY).

Cross-Site Scripting

Inline <script> tags and event-handler attributes (onerror=, onload=, ...) in request parameters.

Local & Remote File Inclusion

PHP stream wrappers (php://, data://, expect://, ...) and remote-URL include/require attempts.

Command Injection

Shell metacharacters (;, |, `, &&) chained with a recognized command -- deliberately excludes a plain & and generic words like “id” to avoid flagging ordinary Joomla query strings.

Known-CVE Coverage

Includes a signature for Joomla's CVE-2023-23752 unauthenticated webservices probe.

Runs Last, Not Twice

Only checked when Protection Mode's own signatures find nothing on that same request -- after the virtual-patch rules, which run first -- and never double-scores a match.

Create Baseline

One click hashes every scanned file with SHA-256 and stores it as your site's known-good snapshot.

Check Integrity Now

Re-hashes and compares against the baseline on demand, or automatically as part of a scheduled check.

Narrow, High-Signal

Only files present in BOTH the baseline and the current scan, with a different hash, are reported -- a brand-new file is left to the regular scanner's own checks.

Never Auto-Updates

The baseline only moves forward when you explicitly rebuild it -- a legitimate update changes files too, so this never silently re-baselines on its own.

Rides Existing Alerts

Drift found during a scheduled check sends the exact same email/Slack/Discord/Telegram alert as a signature-based finding -- no separate notification habit to learn.

Medium Confidence By Design

Flagged at medium, not high -- a legitimate extension update also changes files, and this can't tell the difference from tampering on its own.

Browse the project

Shallow, one-level directory listings so it can walk the tree the way you would, without dumping the whole filesystem into a single request.

Read files

Reads up to 256 KB of a file and tells you plainly when a file was truncated, instead of silently reasoning about a partial view.

Search the project

Matches on both filenames and file contents across PHP, JS, TS, CSS, HTML, XML, INI, JSON, Markdown, and text files, returning the first matching line and its number.

Create and edit files

Writes new files or overwrites existing ones, up to a 256 KB limit per write.

Rename files

Moves or renames a file, and refuses if something already exists at the destination rather than overwriting it.

Delete files

Removes a single file at a time. No recursive directory deletion, so a wrong instruction can't cascade.

Snapshots before every repair

The instant before a file is written, renamed, or deleted -- or a cleanup action touches the database -- its exact prior state is saved. This happens server-side, unconditionally, for every AI edit and every cleanup action. There is no setting to forget to turn on.

Verified, not just stored

Every snapshot is SHA-256 hashed at the moment it's taken and re-verified against that hash before a restore is ever allowed to trust it. A corrupted or tampered snapshot is refused, even if you force the restore.

One click, per file or per whole request

A single AI turn that edits three files is one transaction. Undo the whole thing in one click, or reach into it and restore just one of the three -- your call.

Won't silently clobber a later change

If a file was edited again -- by you, by hand, by anything -- after the repair it's restoring, the restore stops and asks first instead of quietly overwriting work you did afterward.

A real diff before you approve, not just after

The same confirmation step where you approve an AI edit now shows you a line-by-line diff of what's about to change, or a size/hash comparison for binary files -- computed locally, never sent anywhere.

Keep the ones that matter

Snapshots age out automatically on a retention window you control (days and a maximum count) -- but pin any specific repair to Keep, and it's exempt from cleanup for as long as you need it.

Connect once, use everywhere

Account-level configuration means every install under an active license shares the same connection.

Per-turn, stateless requests

Each turn of the conversation is a separate request. Nothing about your project is retained between sessions on the service side.

Your files stay on your server

File tools execute locally. Only tool names, arguments, and results travel over the network -- never a bulk copy of your site.

Site-specific context stays local

Your custom Skill is written to the install itself, not to your account, because it describes this codebase and no one else's.

Unlocks the moment the license validates

Activate or correct a license and the AI Integrations and Pro Features tabs open on the same page load -- no second refresh needed.

Optional by design

Skip it entirely and the scanner, cleanup tools, Protection Mode, and .htaccess advisor all work exactly as they always have.

Scheduled scans

Turn on scheduled scanning and MuRu Guard generates a secret token. Point a cron job or your host's scheduled task at the tokenized URL and the scan runs unattended. The dashboard shows when it last completed.

Email alerts

Send results to any address when a scheduled run finishes, so a new finding reaches you without anyone logging in to look.

Slack

Post findings into a channel through an incoming webhook, so the whole team sees a compromise at the same time.

Discord

Same webhook-based delivery for teams and communities that live in Discord instead.

Telegram

Deliver alerts through a bot to a person or a group chat, useful when the site owner isn't in your workspace at all.

Fleet Dashboard reporting

Opt an install in to report its scan status back to your dashboard account, so agencies can see every site's state on one screen instead of opening each administrator in turn.

Fleet bulk actions

Select any number of sites on the Fleet Dashboard and trigger a re-scan or push a recommended hardening config (Protection Mode, attack blocking, brute-force blocking, bad user-agent blocking) across all of them at once, instead of logging into each site's admin individually.