MuRu Guard Security Scanner

MuRu Guard installs like a standard Joomla extension and runs inside the administrator area. It uses Joomla's own authentication and permission system, so there is no separate scanner URL, access key, or public file to remove later.

The scanner focuses on real-world compromise patterns linked to SP Page Builder's uploadCustomIcon vulnerability, suspicious JCE paths, core entry-point tampering, rogue Super Users, and database payloads commonly seen after Joomla attacks.

Finding the problem is only half the job, so the component also ships the parts that come after it: a live request-blocking plugin, scheduled scans that push results to your team's chat, and a Smart AI Assistant that can open the flagged file, explain what it is looking at, and write the fix -- without ever being able to touch Joomla core or the scanner's own code.

The scanner, cleanup tools, Protection Mode, and .htaccess advisor are free forever, with no account, license key, or feature timer. Upgrade to Pro on your own schedule when you want the Smart AI Assistant, team alerts, and multi-site reporting.

On-demand scanning finds problems after they happen. Protection Mode, powered by the optional MuRu Guard Shield plugin, checks requests as they reach Joomla and records matches in a sectioned Protection Log.

All protection switches are off by default, and authenticated non-guest admin sessions are exempt from request-pattern and country blocking, so you can never lock yourself out by travelling or using a VPN.

A scan tells you which file is suspicious. The Smart AI Assistant is the step after that: its own panel in the left sidebar (Components > MuRu Guard > Smart AI Assistant) where you can ask about a finding in plain language, have the assistant open the file, search the rest of the project for related code, and write the correction back to disk -- all from inside the Joomla administrator.

It works as a multi-turn loop. Each turn, the assistant decides which single tool it wants to run next, that tool executes locally on your own server, and the result feeds into the next turn. Your codebase is never uploaded, indexed, or mirrored anywhere -- only the tool name, its arguments, and its result cross the network, which means the model sees the contents of files it explicitly reads or writes during your conversation and nothing else.

What it can do

What it cannot do

Giving an assistant write access to a production site is only reasonable if the fences are real, so they are enforced in the extension's own PHP -- not requested politely in a prompt the model is free to ignore.

Settings > AI Integrations is where the Smart AI Assistant gets its connection. The AI provider is configured once at the account level rather than per site, so a new install covered by the same license can use the assistant immediately, with no credentials to copy between sites and no API key sitting in each site's database.

A scanner only helps if someone runs it. Scheduled scanning runs the same checks on your own cron schedule and tells you where you already are -- inbox, team chat, or a dashboard covering every site you maintain. This entire section is a Pro feature.

Scheduled scanning, email alerts, Slack, Discord, Telegram, and Fleet Dashboard reporting are all Pro features and unlock with an active license.

Every finding row -- files, Super Users, menu items, database rows -- has a one-click "Mark as Safe" action. Most scanners that offer this just remember a filename or row ID forever, which quietly creates a blind spot: if that exact path is ever genuinely compromised later, a stale dismissal would hide the real problem.

MuRu Guard fingerprints the exact finding text being dismissed, not just its location. If the same file or database row later matches something different -- because its content actually changed -- the fingerprint no longer matches and it reappears as a fresh finding automatically. A dedicated management screen lists every current dismissal with a one-click restore, so nothing stays permanently hidden without a trail.

A read-only advisory panel that reads your site's actual root .htaccess and checks it against a focused set of recommendations: PHP execution blocked inside writable upload directories (the single most direct way to stop a dropped webshell from ever running), directory listing disabled, and sensitive files (.env, .git, backup/SQL files) blocked from direct access -- plus optional security headers.

Every missing check shows a copy-ready rule. MuRu Guard never writes to .htaccess itself -- a wrong edit to that one file can take an entire site down with no way to test a rewrite rule safely before it's live, so this stays report-and-suggest only.

1. 1Review High-confidence findings before Medium-confidence findings.
2. 2Treat core entry-point tampering as the top priority because it can execute on every page load.
3. 3Delete confirmed malware files or folders only through current scan results.
4. 4Ask the Smart AI Assistant to open anything you're unsure about -- it can read the file and explain what the flagged code actually does before you delete it.
5. 5Clean injected menu params with the dedicated clean action instead of deleting whole menu items.
6. 6Remove rogue Super Users from Joomla Admin, then rotate credentials from configuration.php.
7. 7Force logout sessions, check scheduled jobs, and re-scan after cleanup.

1. 1

   Install the component

   Upload and install com_muruguard from Joomla administrator under System > Install Extensions.

2. 2

   Install the shield plugin

   Install plg_muruguardshield if you want live attack logging and optional blocking.

3. 3

   Enable permissions

   By default Super Users can access the component. Grant Manage, Clean, Delete, or Change Settings permissions to trusted groups as needed.

4. 4

   Run a scan

   Open Components > MuRu Guard > Scan, choose the checks to include, and review grouped results.

5. 5

   Configure protection

   Enable the plugin from System > Plugins, then turn on Protection Mode from the scanner settings panel.

6. 6

   Schedule scans and alerts

   In Settings > Scheduled Scanning, enable scheduling, copy the generated token URL into a cron job, and add the email address or chat channels that should receive results.

7. 7

   Activate your license

   Paste your key into Settings > License to unlock the Smart AI Assistant, Fleet Dashboard reporting, and the Slack, Discord, and Telegram alert channels.

8. 8

   Set up the AI assistant

   Open Settings > AI Integrations to connect your AI provider, then write a custom Skill describing this site's conventions so the assistant follows them on every turn.