Cybexsoft Shield protects the administrator and site sign-ins, checks every core file against Joomla's published package, hardens Global Configuration and audits the server. It builds on Joomla's own multi-factor authentication, Scheduler, Action Logs and ACL, and tells you plainly what needs doing.
Free package for Joomla 5.4+ and 6, PHP 8.1+, GPLv2 or later. Install it under System → Install → Extensions. Shield Pro is an optional paid add-on.
Failed sign-in limits with lockouts and email alerts, a built-in CAPTCHA or Turnstile, hCaptcha and reCAPTCHA v2, a honeypot, IP block and allow lists with CIDR ranges, automatic bans for scanners and attack tools, a self-unblock link by email, and a secret word for the administrator address.
Every signed-in browser listed with a sign-out button, new-device emails, password rules including a breached-password check that never sends the password, and forced resets.
Core files checked against the official Joomla package for your exact version and its SHA-512, fingerprints for every other extension, and code where none belongs. Every finding can be diffed, restored, quarantined or ignored. Joomla's Vulnerable Extensions List is checked too.
Global Configuration, user options and the Web Services API checked line by line, with one-click fixes that keep a copy of configuration.php first. Secret rotation and table prefix changes done safely, a server audit, certificate and header checks, and Apache or nginx rules.
An activity log that merges Joomla's action log with Shield's security events, daily maintenance as a Scheduler task, and php cli/joomla.php shield:* commands for status, scans, unblocking, safe mode and settings export.
Multi-factor policy and SMS codes, a firewall that starts before Joomla, rate limiting, geo-blocking, server rules, malware scanning, a tamper-evident audit trail, approvals, profiles, compliance mapping, integrations and reports. A separate package, installed beside the free one.
One year of updates and support, renewable. The price shown is what you pay — Indian orders include GST, everywhere else is tax-free.
Download the free package above, then in Joomla open System → Install → Extensions and upload the zip. Shield appears under Components → Cybexsoft Shield, where the overview shows your security score and what to do first. New versions then show under System → Update → Extensions.
Run php cli/joomla.php shield:safe-mode on, or create an empty file named cybexsoftshield-safe-mode in the site root. Every protection that can stand between you and your site is suspended while logging and settings keep working. php cli/joomla.php shield:unblock <ip> clears a ban and lockout.
Only these, and only for what is named: downloads.joomla.org and GitHub for the official package used by the file scan, extensions.joomla.org for the Vulnerable Extensions List (can be switched off), api.pwnedpasswords.com when the breached-password rule is on (only the first 5 characters of the password's SHA-1 are sent), a CAPTCHA provider if you choose one, and cybexsoft.com only if you enter a Shield Pro licence key.
Buy a licence below, download pkg_cybexsoftshield_pro from your account's Downloads page, install it like any package, and enter the key under Cybexsoft Shield → Licence. Pro needs the free package installed first.
It is kept unless you switch on deleting all data under Settings before uninstalling. Shield's data is also included in Joomla's privacy exports and removals.
Write to us through the contact page or support@cybexsoft.com. Pro customers can also open a ticket from their account.
Start with the free package. Add Shield Pro when you want a firewall, malware scanning and governance on top.
