Know exactly what's hiding in your Joomla site.
MuRu Guard scans for webshells, rogue admins, and SP Page Builder compromise traces -- then helps you clean up, block the next attempt, and prove the site is clean. Free, inside your own Joomla admin.
Available until the offer ends.
Current version: Free 4.0.0Pro 5.2.0
- No account or card required
- Read-only scanning -- nothing executes
- Installs like any Joomla extension
On this page
What MuRu Guard does for your site
Finds what generic scanners miss
Webshells, rogue administrators and SP Page Builder / Helix compromise traces, built from a real campaign. Every finding shows the reason it was flagged.
Cleans up with a safety net
Guided cleanup and an 8-step recovery checklist. In Pro, every change is snapshotted by TimeMachine so a wrong delete is one click to undo.
Blocks the next attempt
Protection Mode stops live attacks in Free. Pro adds an active firewall with rate limiting, virtual patches for fresh CVEs and a secret administrator URL.
Stays on watch
Pro adds file integrity monitoring, scheduled scans with email alerts, reputation and blocklist monitoring and a weekly all-clear digest.
Hardens the site
A Global Configuration audit, database privilege audit, mail authentication check and a guided .htaccess hardening advisor.
AI help when you want it
Pro includes an AI assistant that explains findings and helps with repairs, using the key you provide.
Watch MuRu Guard in action
See the scanner, the firewall and the cleanup tools working inside the Joomla administrator.
Start protecting your site in 3 steps
- 1
Install in ~2 minutes
Download the Free package and install it from System > Install Extensions -- no account, no license key, no setup wizard.
- 2
Run your first scan
Open Components > MuRu Guard (Dashboard). Results are grouped by confidence so you know what to look at first -- and every finding shows why it was flagged.
- 3
Clean up & stay protected
Remove findings with guided actions, turn on Protection Mode to block live attacks, and let scheduled scans and alerts watch the site for you.
Installation, recovery steps and every setting are in the documentation
Free and Pro
Free
A complete scanner, cleaner and real-time shield for one site: filesystem, database and core-integrity scans, Protection Mode and the .htaccess advisor. Supports Joomla 3 to the latest. No account or licence needed.
Pro
Integrity monitoring, active firewall, scheduled scans and alerts, AI assistant, multi-site reporting and the newest audits. Included with a Lyzerslab plan.
Joomla 3 compatible Pro
A Pro build with the full Pro feature set for sites stuck on an SP Page Builder, Helix, EasyStore or SP Property Finder version that can no longer be updated.
Every feature
All of it, grouped by job. Every group and feature has its own link you can copy and share. Items tagged Pro need an active Pro licence.
Detect
Filesystem scan
Media, images, templates, tmp, cache and webroot. Flags suspicious PHP, phtml, phar, shtml.
Core integrity
Entry-point payloads and SHA-256 checks of core files, including its own files.
Database scan
Helix mega-menu XSS, SPPB asset rows, template defacement strings.
Registry cross-check
Spots fake templates, modules, plugins and components via Joomla's extension table.
Rogue users and signatures
Attacker-pattern Super Users; eval/base64, c99/r57/WSO shells, stream wrappers, chr-array decoding.
Homepage watch
Checks the live homepage on every scheduled check and emails you only when it changes: site down, defaced or filled with SEO spam.
Google Safe Browsing link lookup
Checks URLs found inside scanned files against Google's threat lists, using your own API key.
Threat Monitor
Attacks over time, top rules, attack types, a Low to Critical threat level and a filterable event log; 30 and 90 day views, countries and CSV export are Pro.
Search code by snippetPro
Paste an indicator and find every file containing it, literal or regex.
Vulnerable-extension checkPro
Matches extensions against Joomla's Vulnerable Extensions List.
Update auditPro
PHP/Joomla versions, SPPB and JCE status, outdated extensions -- read-only.
Custom signaturesPro
Your own PCRE patterns, validated before they can touch a scan.
Content SEO-spam scanPro
Articles and Custom HTML modules checked through the standard finding pipeline.
Block
Protection Mode
Shield plugin logs and optionally blocks webshell, SPPB RCE and drop-filename requests.
IP, country and bot rules
CIDR allow/block lists, cached GeoIP, bad user agents and brute-force blocking.
Admin Lockdown
Blocks the installer and new backend users; auto-reverts demoted Super Users.
Upload lockdown
An emergency brake: one managed .htaccess rule refuses every file upload (multipart/form-data) until it switches itself off, with the backend spared by default. For the days between a disclosed upload bug and its patch.
Emergency Mode
Extends your backend password to the whole site, with a self-test and automatic rollback, so visitors cannot reach anything while you clean up.
Backend password gate
An HTTP Basic Auth gate in front of /administrator that stops brute-force logins before Joomla even loads, verified with a real request and rolled back if it fails.
Impostor search-bot blockingPro
A request that claims to be Googlebot, Bingbot, Yandex, Baidu or Applebot is checked against reverse DNS and blocked when it is an impostor; a failed lookup never blocks.
Firewall exceptionsPro
List page paths that skip the pattern, virtual-patch and WAF filters; IP, country, brute-force and rate-limit checks still apply.
Active WAFPro
SQLi, XSS, LFI/RFI and command injection, with CVE-2023-23752 coverage.
Virtual patchingPro
Per-CVE rules block the exploit request until you can update.
Privileged login alertsPro
Email on a privileged login from a never-before-seen IP or country. Alerting never blocks.
Temporary IP blocksPro
1h/24h/7d blocks straight from the Threat Monitor event list.
Rate limiting and request rulesPro
Flood protection per IP, plus optional refusal of unusual HTTP methods and requests with no User-Agent.
Recover
Guided cleanup
Scoped delete, menu params cleanup and rogue SPPB row removal.
Smart false positives
Dismissals are fingerprinted to content and reappear if the file changes.
QuarantinePro
Renamed so it can't execute, skipped by scans, restorable in one click.
TimeMachinePro
Verified snapshots before every repair; restore files and database rows.
“I'm hacked” modePro
One-click containment and an 8-step recovery checklist.
Automate
Scheduled scans and email
Secret cron-token URL; results by email.
Slack, Discord, TelegramPro
Webhook and bot alerts for the whole team.
Fleet DashboardPro
Every site in one view, with bulk re-scan and hardening push.
Autopilot ModePro
Removes near-zero-false-positive threats on schedule, AI-verified and restorable. Off by default.
Alert rules and quiet hoursPro
Alert on High findings only, switch individual watches off and hold alerts during quiet hours.
Scheduled client reportPro
A weekly or monthly e-mail with the score and its change, findings, attacks blocked, backup, certificate and Joomla status.
Weekly security digestPro
Plain-text ALL-CLEAR or NEEDS-REVIEW email on a 6-day cadence.
Findings exportPro
CSV/JSON export of the exact finding set; snippets excluded by default.
Harden
.htaccess advisor
Reads your real file and suggests copy-paste rules. Never edits it.
File Integrity MonitoringPro
SHA-256 baseline drift catches payloads in trusted files.
Config, 2FA and exposure auditsPro
17 Global Configuration checks, 2FA enforcement, exposure probes with one-click deny.
Secret admin URL and canariesPro
Hidden /administrator plus honeypot file and decoy admin.
Account-hygiene auditPro
Privileged accounts missing MFA, still named admin, or dormant past your threshold.
Scheduled-task auditPro
Flags orphaned routines, failed runs, and overdue or brand-new tasks.
Runtime verification and TLS watchPro
Live probes of enforced headers (including clickjacking, Referrer-Policy and version disclosure) and guards; warns inside the 14-day certificate window.
Generator tag removal and tmp cleanup
Removes the Joomla version fingerprint from every page and clears old files from the tmp folder on each scheduled check.
Settings export and import
Save your Shield, hardening and alert settings as a JSON file (never including keys or passwords) and copy the same setup to another site.
PHP-in-uploads protection watchPro
Alerts when the rule that blocks PHP in upload folders is removed or stops working, verifies each folder, and re-applies the rule in one click.
PHP configuration auditPro
Grades allow_url_include, display_errors, expose_php, disable_functions, open_basedir and session cookie settings. Read-only.
Backup freshness checkPro
Reads Akeeba Backup's records and warns when the newest successful backup is too old or the last run failed.
Weak administrator password checkPro
Tests privileged accounts against very common passwords on your own server; only a yes or no per account is kept.
Database privilege auditPro
Flags dangerous database grants such as FILE, SUPER and GRANT OPTION with the exact REVOKE to fix each. Report only.
Mail authentication auditPro
SPF, DMARC and DKIM for your sender domain, with fix guidance. Read-only DNS lookups.
Update source integrity watchPro
Flags plain-HTTP update sources and emails you when an update source is added, removed or changed.
Joomla Action Log reviewPro
Installs, user and group changes and configuration saves from Joomla's own Action Log, with a scheduled alert.
Reputation and blocklist watchPro
Google Safe Browsing and Spamhaus ZEN self-checks; emails only on transitions.
AI
Smart AI AssistantPro
List, search, read, edit, rename and delete files by chat, with confirmation and audit log.
Hard fencesPro
Core, configuration.php, entry points and MuRu Guard are blocked in PHP and hidden.
Custom SkillPro
Your conventions (up to 64 KB) are added every turn and stored on your server.
Private by designPro
File tools run locally; only tool names, arguments and results cross the network.
AI IntegrationsPro
Account-level provider connection shared by every install under the license.
Settings, examples and walkthroughs for every feature are in the documentation
What's new
Version 5.2.0 · 15 October 2026
- Firewall rate limiting (Pro) — Temporarily blocks an IP that floods the site, plus optional rules for unusual request methods and empty User-Agents.
- Database privilege audit (Pro) — Flags risky grants such as
FILEandSUPERwith the exactREVOKEstatement; report only. - Joomla Action Log review (Pro) — The security-relevant slice of Joomla's User Actions Log, with a scheduled email for new installs and privilege changes.
- Update source integrity watch (Pro) — Flags plain-HTTP update sources and tells you when an update source changes.
- Mail authentication audit (Pro) — SPF, DMARC and DKIM checks for your mail sender domain with fix guidance.
- Live found-so-far indicator (Free and Pro) — The scan overlay shows a running count the moment something suspicious turns up.
Requirements
- Joomla 3 to the latest 6.x (free version)
- A Joomla 3 compatible Pro build is available
- PHP 8.1 or newer on Joomla 4+
- No external service needed for scanning
Frequently asked questions
Stop worrying about your site -- it's free
The core toolkit is free and open-source, setup takes about two minutes, and every finding shows the exact reason it was flagged. Install it once, switch on protection, and get back to running your site -- MuRu Guard keeps watch from there.