MuRu Guard — Scanner, Protection & AI Assistant

Most Joomla security scanners are generic -- the same signature list regardless of what your site is actually built with. MuRu Guard isn't: it exists because of one specific, real campaign against SP Page Builder's uploadCustomIcon RCE and the Helix Ultimate mega-menu XSS payloads that followed it, and every detection signature in this scanner was built and refined against real infections from that campaign -- not a generic malware wordlist.

If your site (or a client's) runs SP Page Builder or a Helix-framework template, that's not a coincidence you have to explain to a generic scanner -- it's exactly the case this tool was built to understand. Core entry-point tampering, rogue iconfont registrations in the SPPB asset table, Helix-specific mega-menu injection markers, template-styles defacement -- these are checks a generic scanner doesn't run at all, because it doesn't know these frameworks exist.

Latest fixes and additions, released to both Free and Pro unless noted:

MuRu Guard installs like a standard Joomla extension and runs inside the administrator area. It uses Joomla's own authentication and permission system, so there is no separate scanner URL, access key, or public file to remove later.

The scanner focuses on real-world compromise patterns linked to SP Page Builder's uploadCustomIcon vulnerability, suspicious JCE paths, core entry-point tampering, rogue Super Users, and database payloads commonly seen after Joomla attacks.

Finding the problem is only half the job, so the component also ships the parts that come after it: a live request-blocking plugin, scheduled scans that push results to your team's chat, and a Smart AI Assistant that can open the flagged file, explain what it is looking at, and write the fix -- without ever being able to touch Joomla core or the scanner's own code.

The scanner, cleanup tools, Protection Mode, and .htaccess advisor are free forever, with no account, license key, or feature timer. Upgrade to Pro on your own schedule when you want File Integrity Monitoring, the Web Application Firewall, the Smart AI Assistant, team alerts, and multi-site reporting.

On-demand scanning finds problems after they happen. Protection Mode, powered by the optional MuRu Guard Shield plugin, checks requests as they reach Joomla and records matches in a sectioned Protection Log.

All protection switches are off by default, and authenticated non-guest admin sessions are exempt from request-pattern and country blocking, so you can never lock yourself out by travelling or using a VPN.

Protection Mode's own signatures are deliberately narrow -- webshell interaction, SP Page Builder's own RCE, known drop filenames -- matching this scanner's original webshell-cleanup focus. The Web Application Firewall adds a second, broader pass: generic injection-class patterns any Joomla site is exposed to, regardless of which extensions it runs.

Broad, proximity-based matches -- where a signature can't confirm two suspicious things are actually the same parameter -- log for review instead of blocking, so a false positive never reaches the blocking path.

Signature-based scanning only catches content matching a known pattern. A payload hand-inserted into an already-trusted file can dodge every signature check while still being a real backdoor. File Integrity Monitoring catches that class of compromise instead: hash every file once as a known-good baseline, then flag any file whose content no longer matches -- independent of whether the new content looks malicious by pattern-matching at all.

A scan tells you which file is suspicious. The Smart AI Assistant is the step after that: its own panel in the left sidebar (Components > MuRu Guard > Smart AI Assistant) where you can ask about a finding in plain language, have the assistant open the file, search the rest of the project for related code, and write the correction back to disk -- all from inside the Joomla administrator.

It works as a multi-turn loop. Each turn, the assistant decides which single tool it wants to run next, that tool executes locally on your own server, and the result feeds into the next turn. Your codebase is never uploaded, indexed, or mirrored anywhere -- only the tool name, its arguments, and its result cross the network, which means the model sees the contents of files it explicitly reads or writes during your conversation and nothing else.

What it can do

What it cannot do

Giving an assistant write access to a production site is only reasonable if the fences are real, so they are enforced in the extension's own PHP -- not requested politely in a prompt the model is free to ignore.

An AI assistant with write access to your site is only worth using if a bad edit costs you nothing to reverse. TimeMachine is the safety net underneath every repair MuRu Guard makes -- not a separate tool you have to remember to run, but a step the extension takes for you automatically, before it lets anything touch disk.

It covers more than the Smart AI Assistant: bulk file deletion, Clean Code, Clean Menu XSS, and the rest of the scanner's own one-click cleanup actions all get the same protection. Whether the change came from a conversation with the AI or a button click on a scan result, there is always a way back.

What it actually does

How you recover

Every restorable repair shows up in a Protected Repairs list -- a shortcut view right inside the Smart AI Assistant panel showing the most recent ones, and the full history under Settings > Backup & Restore. Each entry shows what changed, who approved it, and when. Restoring it is one button: Restore puts the file (or the whole transaction) back exactly as it was, verified against its saved hash first. If something changed again since, you'll see a conflict warning before anything is overwritten, not after.

Retention is configurable from Settings > Backup & Restore: how many days a snapshot is kept, and a maximum count so storage never grows unbounded on a site the assistant works on heavily. Every snapshot, repair, and restore is also written to the same Protection Log the rest of MuRu Guard uses -- one audit trail, not a second one to check separately.

Settings > AI Integrations is where the Smart AI Assistant gets its connection. The AI provider is configured once at the account level rather than per site, so a new install covered by the same license can use the assistant immediately, with no credentials to copy between sites and no API key sitting in each site's database.

A scanner only helps if someone runs it. Scheduled scanning runs the same checks on your own cron schedule and tells you where you already are -- inbox, team chat, or a dashboard covering every site you maintain. This entire section is a Pro feature.

Scheduled scanning, email alerts, Slack, Discord, Telegram, Fleet Dashboard reporting, and Fleet bulk actions are all Pro features and unlock with an active license. A bulk action can't be pushed into a site instantly -- there's no way to reach into a site directly, so it's picked up and executed the next time that site checks in on its own schedule.

Every finding row -- files, Super Users, menu items, database rows -- has a one-click "Mark as Safe" action. Most scanners that offer this just remember a filename or row ID forever, which quietly creates a blind spot: if that exact path is ever genuinely compromised later, a stale dismissal would hide the real problem.

MuRu Guard fingerprints the exact finding text being dismissed, not just its location. If the same file or database row later matches something different -- because its content actually changed -- the fingerprint no longer matches and it reappears as a fresh finding automatically. A dedicated management screen lists every current dismissal with a one-click restore, so nothing stays permanently hidden without a trail.

A read-only advisory panel that reads your site's actual root .htaccess and checks it against a focused set of recommendations: PHP execution blocked inside writable upload directories (the single most direct way to stop a dropped webshell from ever running), directory listing disabled, and sensitive files (.env, .git, backup/SQL files) blocked from direct access -- plus optional security headers.

Every missing check shows a copy-ready rule. MuRu Guard never writes to .htaccess itself -- a wrong edit to that one file can take an entire site down with no way to test a rewrite rule safely before it's live, so this stays report-and-suggest only.

1. 1Review High-confidence findings before Medium-confidence findings.
2. 2Treat core entry-point tampering as the top priority because it can execute on every page load.
3. 3Delete confirmed malware files or folders only through current scan results.
4. 4Ask the Smart AI Assistant to open anything you're unsure about -- it can read the file and explain what the flagged code actually does before you delete it.
5. 5Clean injected menu params with the dedicated clean action instead of deleting whole menu items.
6. 6Remove rogue Super Users from Joomla Admin, then rotate credentials from configuration.php.
7. 7Force logout sessions, check scheduled jobs, and re-scan after cleanup.

1. 1

   Install the component

   Upload and install com_muruguard from Joomla administrator under System > Install Extensions.

2. 2

   Install the shield plugin

   Install plg_muruguardshield if you want live attack logging and optional blocking.

3. 3

   Enable permissions

   By default Super Users can access the component. Grant Manage, Clean, Delete, or Change Settings permissions to trusted groups as needed.

4. 4

   Run a scan

   Open Components > MuRu Guard > Scan, choose the checks to include, and review grouped results.

5. 5

   Configure protection

   Enable the plugin from System > Plugins, then turn on Protection Mode from the scanner settings panel.

6. 6

   Schedule scans and alerts

   In Settings > Scheduled Scanning, enable scheduling, copy the generated token URL into a cron job, and add the email address or chat channels that should receive results.

7. 7

   Activate your license

   Paste your key into Settings > License to unlock the Smart AI Assistant, Fleet Dashboard reporting, and the Slack, Discord, and Telegram alert channels.

8. 8

   Set up the AI assistant

   Open Settings > AI Integrations to connect your AI provider, then write a custom Skill describing this site's conventions so the assistant follows them on every turn.

9. 9

   Stay updated -- no separate download step

   MuRu Guard registers itself with Joomla's own update system on both Free and Pro, so a new release shows up right in System > Manage > Update (or Components > MuRu Guard's own version badge) like any other extension. Click Check for Updates there, then Update -- no need to come back to this page to grab a new zip.