Sensitive-file exposure probes + one-click deny

Backup copies of configuration.php and similar files are only dangerous if the web server actually serves them. New exposure probes (Pro) in the runtime-verification modal request them over real HTTP and report pass/fail — proof, not file-text guesswork.

One-click deny

Where a probe fails, one click installs a managed deny block in .htaccess: it backs up first, self-tests that the block works, and offers rollback. Backups live in the extension's protected data folder (never as webroot siblings the scanner would flag), and nginx users get a ready-to-paste snippet instead.

Joomla 3

Coming to the Joomla 3 edition with v3.0.0.