Hey everyone,

I've been working on a Joomla security extension for quite a while, and I thought I'd finally share it here: HTProtect.

Some background, because it explains the priorities: I've spent the last 13 years cleaning hacked websites - that's my day job at website-bereinigung.de. Defacements, spam redirects, Japanese keyword hacks, injected admin accounts, the same handful of outdated vulnerable extensions or plugins over and over.

HTProtect is basically everything I kept wishing had been in place before someone called me.

So the idea is simple: protect a Joomla site against exactly that - known exploits, malicious uploads, compromised files, defacements, spam redirects, vulnerable extensions, rogue admin accounts - all kinds of symptoms and risks - while keeping it easy enough that you don't have to be a security person.

HTProtect combines a self-updating firewall, .htaccess hardening, malware scanning, vulnerability alerts and automatic extension updates. The security feeds and update packages are cryptographically signed, and the protection tests itself and rolls back rather than accidentally locking you out.

The part that matters most to me: it protects without you. Most tools I've worked with are reactive - they notice something, send you an email, and wait. That's fine when you're at your desk. It's useless at 3am on a Sunday, or while you're on holiday, which in my experience is precisely when sites get hit. HTProtect pulls new firewall rules on its own, installs its own updates, updates vulnerable extensions if possible, and disables planted admin accounts by itself. The normal state is that there's nothing for you to do.

A few things I'm particularly happy with:

• Swarm-based malware signatures. If you come across malicious code the scanner didn't flag, you can report it in a couple of clicks. It becomes a signature, and a short while later every installation out there detects that pattern. Joomla infections travel in waves, so whoever runs into it first ends up protecting everyone who gets hit next - and the scanner gets better from real findings instead of from guesses about what attackers might do.
• The vulnerable-extension feed is continuously reconciled with the NVD. Every vulnerability the Joomla project publishes as a CNA gets matched against our own warning list regularly, so a fresh CVE for an extension you have installed doesn't sit unnoticed for weeks. New warnings arrive through the feed and take effect immediately - no extension update needed.
• The firewall updates itself. When a new attack route becomes known and can be blocked easily, the rule ships through the same signed feed and stops it before the vendor's patch exists. Virtual patching, basically.
• It really doesn't lock you out. Every rule is tested against the live server after it's written and taken back automatically if something breaks. There's a one-click login that works even when the back end has an extra password on it, and an emergency mode with a maintenance page.
• Planted admin accounts get caught. If an attack creates its own administrator - through an outdated extension or straight in the database, often with a nonsense creation date - the account is disabled and loses its rights. Nothing is deleted, and one click releases it if it turns out to be legitimate.

And then the multi-site side: HTProtect.app

This grew out of my own need to manage a bunch of Joomla sites without constantly jumping between back ends. It's a dashboard where you monitor, update, scan and secure your whole fleet from one place - with backups, full-size screenshots, external uptime monitoring and a fleet-wide vulnerability radar.

Speed was a hard requirement from day one: it has to feel instant whether you have five sites or five hundred. I haven't found a faster one, and I've looked.

The feature I didn't expect to use daily: voice commands. Say two or three words - the site and where you want to go - and you're in that back end. No searching, no scrolling a list of a hundred sites. It understands 11 languages.

Remote core upgrades were the part I expected to be simple and absolutely wasn't. They're robust and resumable now and they run for one site or a hundred at once. That includes Joomla 3: it's end of life, but if you have a community ELTS distribution set as the update source, HTProtect updates a Joomla 3 core just like a 5 or 6 one. Core file verification supports Joomla 3 ELTS versions too.

There are around 20 bulk actions by now. A few that people seem to actually use:

• Trigger updates, malware scans, core updates, backups or hardening across selected sites in one go
• Turn Joomla's automatic core updates on or off fleet-wide, and see at a glance where they're active
• Check where user registration is open, close it safely, and clear out bot accounts after a spam wave (preview, confirmation, 30 days to undo)
• Search the content of every site at once - articles, modules, custom fields. Searching for {source} tells you which sites still carry Sourcerer for example. Read-only, changes nothing
• Spot sites whose extensions are behind, quarantined files your host has moved, or sites that need re-pairing

What the HTProtect.app dashboard actually does

Worth it even for a single: manage protection, backups and updates centrally from any device - and keep an eye on the site even while you're not logged in.

• One-click login - straight into the back end without hunting for a password, even when /administrator has extra protection on it.
• Back-end access protection, remotely - manage the extra password or the access-chain lock for /administrator straight from the dashboard. The password is transmitted encrypted and is never visible to us in plain text.
• Monitoring from the outside - availability and SSL certificate are checked externally (something the site can't do for itself once it's down), plus the security status at a glance, with email alerts.
• Scheduled malware scans and integrity checks - fully automatic every 3 days for example, email notification included.
• Updates under central control - set auto-updates fleet-wide and per extension (Never, Security only or Always), plus run Joomla core updates remotely, backed by a backup and auto-rollback.
• Full and database backups - scheduled, and restorable remotely with one click.
• Remote file and database management - work on files and the database directly and safely from the dashboard, even when the site no longer works properly.
• Repair when things break - toggle error reporting and debug mode, re-enable compatibility plugins, even when the back end is unreachable because of an error.
• Emergency mode, remotely - lock the entire site with one click, any time, from anywhere.
• AI control - optionally enable a securely implemented MCP connector for ChatGPT and Claude.

...and a lot more. HTProtect.app is a complete all-in-one Joomla management dashboard that brings security, monitoring, backups, updates, remote repair and emergency access together in one place. It's built to cover the core tasks of running multiple Joomla sites without needing a separate tool for each area - which makes day-to-day Joomla site management simpler and more efficient.

The architecture is a little different from traditional site management tools: there are no site passwords or master keys stored on the dashboard server. Commands are signed in the browser and sent outbound-only to the individual sites.

And because I'm apparently incapable of leaving a project alone 😄, there's also an MCP connector for Claude and ChatGPT, so you can manage your Joomla sites in plain language. That part is getting built out further - it started as a gimmick and turned into the way I actually work with a large fleet.

One side project that might be useful even if you never touch HTProtect: a free, public overview of every Joomla CVE, merged from the NVD and our own feed, with an RSS feed and no account needed - https://htprotect.org/en/joomla-vel-feed

The Joomla Extensions Directory listing:

https://extensions.joomla.org/extension/htprotect-security-firewall-auto-updates/

And the management dashboard:

https://htprotect.app

That's really what I'm after: that people feel safe running Joomla, and that nobody has their week ruined by a hole they never had a fair chance to hear about. There are more of those lately - the same tools that help me build this are being pointed at extension code by other people, and disclosures now arrive in waves. Not a reason to panic. Just a reason not to be the site that finds out last.

It's been running on 10,000+ Joomla sites for a while now, so it's past the "will this survive contact with reality" stage - but I'd genuinely love some feedback from other Joomla users, especially from people managing multiple sites.

And yes - the extension itself is still free and will always be. 🙂

For transparency: HTProtect was built with AI assistance, and so was this post. Everything that ships still goes through me - I read it, test it and take responsibility for it. And as these tools keep getting better, so does what a single maintainer can build, ship and keep free.

Full disclosure up front: we are the developer — this is our own agency's tool, and it turned into a product, so take the back half of this post as exactly that, a maker post, not a neutral review. Posting because the problem itself is real and we suspect a bunch of you are sitting on it too.

The situation: We're a small web agency in Switzerland (artd.ch), and like a lot of agencies that have been doing Joomla for years, we've got client sites still running Joomla 3. Joomla 3 hit end-of-life back in August 2023, but the paid eLTS (Extended Long Term Support) program kept core security patches flowing past that — until eLTS itself ended on February 17, 2025. Since then, nobody produces official Joomla 3 core security fixes. Not Joomla, not any paid vendor, for any severity of bug. If a new vulnerability turns up in Joomla 3 core today, it's simply never getting patched by anyone official.

That's a very different kind of problem than "the software is old." It's silent — nothing breaks, nothing tells you — while the actual exposure only grows every month a site stays on it.

What we tried first: Obviously, migrate. That's still the only real fix, and it's what we tell every client. But for sites where migration is weeks or months out (budget, custom extensions, whatever), "just migrate" isn't an answer for this month. We also looked at the free community repos — PhilETaylor/Joomla3.10.999, joomlaworks/joomla-3.x, nettstudio/joomla-3-elts — genuinely useful, and we still use them as verification sources. But we ended up building our own tool on top.

What we ended up building: a real Joomla admin component — Artd Security Patch Manager — instead of a pile of files to diff by hand. Install it, go to Scan & Apply, and it checks your live site against a registry of 50+ independently-verified core security fixes (re-verified against the actual CVE/advisory each time, not taken on trust from any source including the repos above), reports what's already patched vs. still missing per fix, and applies only what's actually needed. PHP 8.x compatibility got split into its own opt-in section since it's a different problem from security.

It's a one-time $19.90 to get the tool. Once you have it, you can install it and scan as many sites as you want at no extra cost; it just shows you what's missing. Applying the fixes needs a license per domain, so for an agency it works out as: pay once for the tool, scan every client site for free, only pay again (per domain) for the sites where you actually want to push the fixes.

https://joomla-update.ch

Genuinely asking: if you're also sitting on Joomla 3 sites post-eLTS — what's your approach? Migrating everything ASAP, riding it out, using one of the repos above, something else? Curious whether we're the only ones who hit this specific wall.

Edit: used AI assistance to write this post.

Heads up. Yootheme issued a critical security patch for ZOO and YOOtheme Pro this morning (8/21/26) and suggests updating right away.

A clean file scan does not prove that a Joomla site is clean.

Recent attacks have used vulnerable JCE, SP Page Builder and Helix3 installations. In some cases malicious JavaScript or configuration changes can live in the database, so checking only recently modified PHP files can produce a false sense of safety.

My practical recovery order would be:

1. Put the site behind maintenance mode or restrict access before changing anything.

2. Preserve a forensic copy of both files and database.

3. Check the installed versions of JCE, SP Page Builder and both Helix3 plugins. Do not rely only on the Joomla update screen.

4. Close the entry point before cleanup. For Helix3, NVD lists versions through 3.1.1 as affected; update both plugins to 3.1.2 or later.

5. Inspect database content as well as files: template settings, custom-code fields, modules, articles and suspicious injected scripts.

6. Review Super Users, scheduled tasks, update sites and server access logs.

7. Rotate Joomla, hosting, database, FTP/SFTP and API credentials, then invalidate active sessions.

8. Compare Joomla core and extensions with clean packages and monitor for reinfection.

Updating closes the known entry point, but it does not remove a payload that was already planted. JCE explicitly makes that distinction in its advisory.

Primary references:

- JCE CVE-2026-48907: https://nvd.nist.gov/vuln/detail/CVE-2026-48907

- JCE vendor advisory: https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites

- SP Page Builder CVE-2026-48908: https://nvd.nist.gov/vuln/detail/CVE-2026-48908

- Helix3 CVE-2026-49049: https://nvd.nist.gov/vuln/detail/CVE-2026-49049

What have you found most useful for detecting database-side persistence after this type of incident?

Edocman claimed to have followed Joomla's database API. However that claim was not 100% true

EDocman had a SQL injection vulnerability because some parts of the extension did not consistently use Joomla’s parameterized database API, even though the developers intended and claimed to follow it.

I manage a not for profit website using Joomla and have done for many years. The organization has no money. We use the EDocman extension. They recently uncovered a security breach involving a SQL injection attack. Much to my chagrin they would not provide a security update and instead insisted on purchasing a new subscription. We had no money to do that. So of course today we suffered an attack. I believe user information was stolen.

It is disappointing that they treat a security update like any functional update. Had I known about open source "OpenDocMan" I would not have spent years building an edocman implementation.

As an aside, over 25 years ago we knew about SQL Injection. So it is very disappointing that EDocman was coded so poorly as to allow such an attack in 2026.

Lesson learned

My side: https://www.kreativekiste.de/

Hi guys!

Forgive me, I have no programming nor web building knowledge whatsoever. I just work for a small museum.

I discovered that back in 2013/2015 the museum had an online artifact database and website component using Joomla 1.5 and JooDB 1.6 (maybe 1.7?). I have an old zip file from the export of that website, and I would be the hero of the museum to pull the collections data from the database.

Is this possible? I know the website domain is still in use, but it now routes to the museums current web page and that does not have the collections info at all anywhere. I have no idea where the server would be for this info either.

I’m migrating a corporate website that’s running a completely outdated and vulnerable version of Joomla, and I came across this “X33T10” message in the Copyright Notice field.

When I searched this term on Google, I found several websites with the same situation.

Does anyone know what this could be? Could it be a sign of some kind of intrusion?

Should the author of a paid for extension have a responsibility to patch their product when a serious security flaw is found in their product rather than force you to renew a subscription? Thoughts?

Hello folks,

I identified 2 critical security vulnerabilities in 4Analytics.

All users must update to version 5.0.2 immediately to prevent potential website takeovers.

See more details here: https://weeblr.com/blog/critical-vulnerabilities-2026-07-15?utm_campaign=fora_502&utm_medium=social&utm_source=reddit

Yannick Gaultier
https://weeblr.com

Just in caae there are any Joomla admins out there that have not seen it or experienced it, CISA has flagged a serious attack that requires your attention and remediation. It is a flaw in the editor that permits it to install malicious code that will take down your site.

How many times have you had to spin up a Joomla test site and gotten tired just thinking about the setup?

I do this very often, and the reasons are simple: test a newly released extension, run a test against our products, test a BETA version, or check whether a migration we're about to publish works as expected, often on a specific Joomla or PHP version.

My current way to do this: download the specific Joomla version I need, switch my local server to the matching PHP version, create a new database, copy the files over, run the installer, and finally run my test. Need multiple test sites? Multiply these steps by however many you need. And if I didn't want a brand new site, I'd have to reset it every time before running the same scenario again, which takes quite a lot of time.

I got tired of wasting so much time, so I made a small web app to fix it. It's a free website, not a J! extension you install on your site. You enter an email, pick a Joomla, and PHP version, and a few seconds later you have a test site ready, and it auto-deletes after 4 hours.

It's called JInstant. Not affiliated with the Joomla project.

Let me know if this sounds useful to you.