mySites.guru changelog
What changed in the mySites.guru dashboard over the last three months, newest first. 666 changes since 1 August. Customers can read the full history in the dashboard.
October 2026265 changes
New
- You can now choose what each team member can do on their sites, as well as which sites they see. The new Permissions section on a team member's page sets each area (backups, extension updates, core upgrades, admin sign-in, file manager, site users, monitors, reports and more) to no access, view only or manage, with Viewer and Operator presets to start from. Anything a member can't do is greyed out or hidden for them. Thanks Ivan! Check it out
- Pause updates on a site: it stays listed and monitored, but nothing updates it, not Update all, the API, MCP or the auto-updates that run with each snapshot. Switch it in Config > Checks and alerts, or from the site's group on the Updates page. Thanks Tim! Check it out
Improved
- Updates page: Shift+click selects a range of rows, a group's box selects the whole group, and the Update button updates just what you selected. Group > Order groups puts groups largest or smallest first, or A to Z or Z to A. Thanks Tim!
- Every update row now has a Snooze button: skip this version, snooze for a week or a month, or ignore it on that site. It is on the Updates page and on each site's Updates tab, and Update all, the API and MCP now refuse a snoozed update. Thanks Tim!
- Site Screenshots has a filter box, All, Pending and Failed filters, and a small, medium or large size switch. Each screenshot has View full size, Download and Retake buttons, and clicking it opens the site. Check it out
- Joomla Update Sites is now a sortable table, one row per update site, showing how many of your sites use it, whether auto update is on, and a Download key column that opens the key page for that product. Check it out
- Mass Upgrade Sites is now a table of the sites with a newer core release available. Check upgrade paths fills in what each site is offered, and Upgrade runs the sites you tick. Check it out
- Server Requirements is now a table grouped by server, worst server first, with a column for each requirement tier. Re-check one site or a whole server, and Copy request gives you the text to send your host. Check it out
- API Exposure For All Sites is now a sortable, filterable table. Each site shows Password logins, API on, API off or Not measured, with quick filters for sites that have credential holders, stale credentials or API use this week, and a Revoke button where accounts hold API credentials. Check it out
Fixed
- Joomla Update Sites no longer counts a site as using an update site after the extension has been removed from it.
New
- Read and change your email switches through the API (GET and PATCH /api/v1/me/notifications) and MCP (get_notification_preferences, set_notification_preference). API docs
- Every email you can switch off now ends with a "Turn off this email" link that opens its switch on the Email tab. Check it out
Improved
- The PHP security release page lists your affected sites as a filterable table, and an Add button on the page records a host's back-ported build. Check it out
- Your Account Profile, Your Activity Trail, VAT Declaration, Two-Factor Authentication, API Clients and GDPR export pages now use the same layout as the rest of mySites.guru, and Your Activity Trail is a filterable table.
- AI Integration Configuration shows the models as a table you pick from, with what each one is best for and roughly what it costs per 1,000 files. Check it out
- Client Reports shows your schedules in one table, each with its reports and their status (Queued, Running, Failed or Ready) underneath, and asks before deleting anything. Check it out
- Top 50 Joomla Extensions and Top 50 WordPress Plugins are now tables ranked by the share of sites running each one. Check it out
- An extension's page lists the sites running it as a table with the extension's details beside it, and Remote install works on the sites you tick.
- Joomla Extensions and WordPress Plugins are now sortable tables listing every version you run, including alpha and beta versions the old page hid, with grouping by type or developer and CSV export. Check it out
- The Joomla 5, Joomla 6 and WordPress 7 Compatibility pages are now sortable, filterable tables that check each site's PHP and database version against the minimum and recommended versions, with CSV export. Check it out
- The Email tab shows how many emails are off in each group, and how many times each email was sent to you in the last 30 days.
- Processes Running Deleted Code (beta) now also finds a program run from your site's own folders or a temp folder, or one pretending to be PHP or the web server. It used to look at PHP processes only, so a hacked site's binary disguised as LiteSpeed PHP could read as clean.
- Sites running on Amazon Aurora MySQL now show as Aurora, not plain MySQL, and their database end of life warnings follow Amazon's Aurora support dates. An Aurora 3 database is no longer flagged as end of life just because MySQL 8.0 is.
Fixed
- Clicking an Aurora MySQL database pill on All Your Sites now filters to that Aurora version.
- Reverting a file in the File Manager when it has no core original no longer leaves the file empty.
- Force Multi-Factor Authentication For Super Users now stops and tells you why when the Joomla site has no MFA plugin enabled. Before, it locked every Super User out of the administrator.
- Team members can now turn off the File Manager turned on email and the bulk user account changes email.
New
- Universal User Management can now Set groups, Offboard or Delete the accounts you tick, across many sites in one go. Offboard moves a Joomla account to the group you pick and blocks it, and removes every role on WordPress. Check it out
- Add one user account to many Joomla and WordPress sites at once, choosing its group on each site. Check it out
- Downtime alerts only: one switch on the Email tab of your notification settings stops every email except site down and site back up, including any new email types we add later. Password resets, invoices and reports you ask for still arrive. Thanks Tim!
- The main left menu now folds to a narrow strip of icons: click « at its foot, double-click its right edge, or press [ (or m then f). Your choice is remembered. Hover an icon for its name and count; a dot marks anything that needs attention, red for hacked. On a Manage Site page, { folds both menus at once. Thanks Christian!
Improved
- The list of every site's result for one check is now a sortable, filterable table whose results match each site's Snapshot tab, with bulk Turn on and Turn off for switch checks.
- Web Servers is now a table with one row per server, listing its sites, platforms, PHP versions, and hacked and not connected counts. Click a row to see those sites. Check it out
- Updates To Do shows which rows are being re-checked, with a spinner in place of the checkbox, and updates each site's rows as its answer comes in.
- Joomla group pickers in Universal User Management show the site's real group tree, nested the way Joomla nests it.
- Updates To Do gives extension names more room, moves the Update and Retry buttons into the Actions column, and puts the extension type (plugin, component, module) in its own Type column, off by default and one click away in Columns. Check it out
- Your Account is now one table grouped into Account and security, Financials, Preferences, Tools and Logout, with a Status column that shows where each setting stands: two-factor on or off, VAT declared, open support requests, Cloudflare connected, saved download keys, monthly or yearly plan. Check it out
- Site Group Tags can be put in your own order by dragging, and has a filter box.
- SSL Expiration Dates is now a sortable, filterable table like All Your Sites, and its expiry pill follows your SSL badge setting. Check it out
- Updates To Do has a Remote Install bulk action that opens Remote Install with the sites you selected already picked. Check it out
- The Alternative Downtime Notification Address now sits in the Uptime Alerts panel on the Email tab, next to the other downtime settings. Thanks Tim!
- Every email mySites.guru sends now has its own switch on the Email tab, including ones you could not turn off before, like API login alerts, AI analysis results, File Manager changes and plan change emails. Thanks Tim!
Fixed
- Helix Ultimate vulnerability alerts no longer tell you to install the template by hand. The shaper_helixultimate template now shows in Joomla Updates, and in mySites.guru, as its own update next to the Framework plugin, so update both. Thanks Trebor! Read More...
- Saving a WordPress account in Universal User Management no longer changes the person's display name or their author page address.
- Re-check all sites on Updates To Do no longer says sites did not answer when they had. Accounts with more than 200 sites are checked in batches, and the progress strip now counts the whole re-check (for example 260 of 260 answered) instead of one batch. Thanks Teddy! Check it out
New
- Save your vendor download keys (Akeeba, Regular Labs, YOOtheme and others) once on the new Download Keys page, then send them to the sites you pick. It runs in the background, so you can close the page. Check it out
- Spot Joomla extensions that are missing their download key. Paid extensions need one before updates can install, and you can now set or replace it from mySites.guru: we write it into Joomla and check for updates again straight away. It shows on the Important tab, the Updates table and the Update Log. Check it out
- Two new WordPress checks flag privacy export and remove requests that people have confirmed and that are now waiting on you.
- WordPress 7.1.4 Released!
- PHP versions that PHP never released, like the 7.4.34 some hosts offer (PHP's last 7.4 was 7.4.33), are now marked as your host's own build on the PHP pill, the Important tab, snapshots and reports. A new Unofficial PHP build filter on All Your Sites lists them, and the request you copy for your host now asks which security fixes they back-ported. Check it out
- The first time you have unread updates, a short What's new summary opens with the newest changes and shows you where the megaphone lives in the top bar. After that, the count on the megaphone does the job. Check it out
- On Manage Site, press n then v to open the site in a new tab, handy for checking a site after an update. Thanks Bas!
Improved
- Download Keys has a rail on the left to show one vendor's products or only the products missing a key. Check it out
- Your account settings (2FA, password, notifications and preferences, API clients, billing) are now listed under Your settings in All Tools, and you can star them into your left menu.
- All Tools has a new layout. Pick a section from the rail on the left (Your starred, Most popular, New, Joomla only, WordPress only, Users and access, Your settings and more), search every tool from the bar above the list, and click anywhere on a row to open the tool. Press [ and ] to move between sections. Check it out
- The Set key dialog now offers the keys you have saved for that vendor, and can save a key you paste for your other sites.
- WordPress Pending privacy request checks are now amber, and their fix removes only expired requests, leaving live ones for people to confirm.
- Joomla Completed Export and Remove privacy request checks are now information only, because Joomla keeps completed requests as your record of answering them.
- Switching off Use Default Update Channel on a Joomla site now asks which channel to move to, instead of quietly putting the site on Joomla Next.
- The User Manager tab on each site is now a sortable table of all its accounts, with quick filters for blocked, unactivated and super admin accounts. It refreshes in place after each change.
- Universal User Management is now one page. Search all your connected sites for a person, tick the accounts you want, and change their details, set a new password or block them in one go. A bulk password change also signs those accounts out of any open sessions, each change goes in your user manager log, and team members can use it on the sites they manage. Check it out
- Universal User Management: every search result now has a Password button beside Edit, so you can set a new password straight from a search. Thanks Adi! Check it out
- Search All Your Sites by version again: "joomla 4", "joomla 5.3", "wp 6.8", or just "5.3.2".
- The Update Log row menu now has Visit site and Admin login. Check it out
- Update all can skip its confirmation: tick "Don't ask again on this browser". The Ask before updating button turns it back on.
- Updates groups now stay in place while you update, and finished rows stay on the page as Updated, with Visit site and Admin login links, until you reload. Check it out
- The Update Log now has View site and Admin login on every row and in the row menu, as on the Updates page. Check it out
- The Database pill on All Your Sites now filters like the PHP and CMS pills: click it to see only sites on that MySQL or MariaDB version.
- Search All Your Sites by version again: type Joomla 4, WordPress 6.5, wp 6.5.2 or 4.5.6 to list only sites on that version. Check it out
- Large Investigate file lists load and search faster, site lists refresh faster when nothing has changed, and Cmd+K opens faster on large accounts.
- Update, Cancel, Retry and Preview results respond the moment you click, and a double click no longer sends the request twice. Update all is much faster on large accounts.
- Manage Site opens faster. The loading placeholder fills the page, Important appears at once, Quick Snapshot loads in the background so it opens without a wait, and a folded side menu stays folded on page load.
Fixed
- Your Update Sites now shows the right count of disabled update sites.
- The WordPress comment moderation fix now says the comments move to the bin, which is what it does.
- WordPress privacy request counts are no longer capped at the site's posts per page setting.
- The Admin Tools breaches check now also finds the current admintools_blocked.php log file, not just the old breaches log.
- Joomla privacy checks now show No Data instead of OK when the site's privacy table is missing.
- The Joomla update emails check now spots a disabled Update Notification task plugin, and switching update emails back on enables that plugin again.
- Latest Vulnerabilities now shows each advisory's title, and long extension names no longer overlap the row below. Check it out
- Snapshot and Audit check titles no longer show a link as their tooltip.
- Release Radar rows now open the extension's page, which lists every version your sites run. Check it out
- Hovering a check name in the Snapshot and Audit tables no longer shows an internal link as a tooltip.
- Reloading the page while an audit runs now shows the audit's progress again, even if you had opened Preview.
- Joomla sites no longer show an older Joomla version during or after an audit. The version now always comes from the latest snapshot. Thanks Rob!
- Pausing or unpausing a site now shows in Remote Install, Audits and Backups right away instead of up to five minutes later.
- Snapshot and Audit switches show their new position as soon as you flip them and no longer jump back while the new snapshot runs. Cloudflare switches update straight away.
- When your web host's firewall drops our connection ("unexpected eof while reading"), the error no longer says your SSL certificate is broken or sends you to SSL Labs. It now says your host closed the connection and points you to our IP addresses to allow. Check it out Thanks Justyna!
Info
- SiteGround has whitelisted both mySites.guru IP addresses across its whole network, so its Anti-Bot AI no longer challenges our audits, backups, updates, connection checks or uptime checks. You do not need to send SiteGround a ticket. Read More...
New
- 16 checks now have a Learn More page for the first time: the Joomla and WordPress privacy request checks, Joomla's update channel and update email checks, the Admin Tools breaches log, and WordPress comment moderation and trash.
- Connect a new Joomla or WordPress site that already has Akeeba Backup installed and we now connect Akeeba for you after the first snapshot, so the Backups tab is ready without a click. Like the Connect button, this resets Akeeba's secret word, and the site's Activity log notes it.
Improved
- Config, Refresh Core Files, User Manager and API Credentials Manager now open as tabs inside Manage Site, and their old links still work.
- Manage Site opens faster: each tab loads the first time you open it, and tabs you don't open no longer call your site.
- Learn More pages have a new layout. Each opens with your site's result for that check and the action to take, then covers our recommendation, how the audit checks it, how to fix it and the background, with further reading alongside. Press i to go straight to the fix.
- Remote Install takes a zip dropped anywhere on the page, works out whether it is a Joomla or WordPress package, and only offers sites on that platform. Sites that fail, or never reply, link straight to their extensions so you can check. Check it out
- Every Investigate file tool (Hacked Files, Suspect Content, Modified Files and the rest) is a fast table. Search by file path or by verdict, click a file name to see the content that matched, and find Edit and the other actions under More actions. About this check now sits above the table.
- File Manager Access is a fast sites table: see which sites have the File Manager switched on, and turn it on or off for one site or many at once. Check it out
- File Manager Activity Log is a fast table, and Export CSV now exports exactly the rows your filters show. Press f l to open it. Check it out
- The File Manager is a fast searchable table: sort, filter and search a folder's files, with the same dialogs and actions as before.
- While an audit is running you can press Preview results to see the checks table so far. Checks the audit has not reached yet show as Pending instead of a misleading OK, and you can still open Investigate on them.
Fixed
- The disk space row on the Important tab now shows used, total and free space in plain words instead of raw data.
- Privacy request checks now say 1 Request, not 1 Requests. The WordPress comment checks show No Data when a snapshot has no count.
- Learn More pages opened without a site no longer send you back to your sites list.
- A long card inside a dialog now scrolls instead of being cut off.
Updated
- The Disable Auto Updates check now applies from Joomla 5.4.0.
New
- Prefer tabs? Move the Manage Site menu along the top with the button under it, or press n m. Your tables get the full width back, each group opens a list of its pages, and your choice follows you to every browser. On a phone the menu is a single page picker.
- Snooze an update on the Updates page: for this version, a week, a month, or for good.
- Back up, then update: sites with Akeeba Backup or All-in-One WP Migration take a fresh backup before their updates run, and if the backup fails their updates are cancelled.
- The Updates page is now one table of every extension, plugin and theme update across your sites. It opens with the results of your last check, re-checks anything older than six hours on its own, and lets you update one row, a whole extension, a server, a selection or everything. Check it out
Improved
- Search Engine Visibility checks are out of beta.
- Editing a team member is one page with a menu for Details, Account type, Site access and Activity, and site access is a searchable table of your sites.
- Latest Vulnerabilities and Your Releases Radar now sit under Needs Attention in the left menu.
- More pages are fast searchable tables: a site's Activity log, API activity, Baseline, Extensions and Updates, plus Auto Sign In and Latest Vulnerabilities. Check it out
- The Important tab is one list, most urgent first, with every open Joomla core vulnerability listed and linked to its details.
- A running audit shows a live ledger of what it has checked, counts up as it goes, and opens the results table when it finishes.
- Snapshot and Audit checks are now fast tables: filter them, group by section, hide the OK rows and see what changed since the last snapshot. Cmd+K finds any check on the page and opens its row.
- The Manage Site page has a menu down the left instead of tabs: every page of the site under Health, Manage, Alert and Activity, with your update count, vulnerable extensions and last backup age beside them. Press n then a letter to jump straight to a page. See the keys
- The Update Log is now a fast searchable table: filter to failed, overnight or by hand updates, group by day or extension, read each site's error inline, open its full reply, and retry a failed update in one click. Check it out
- The Needs Attention row is now Updates To Do, and its count drops as each update succeeds.
- The progress counter in the header now matches the Updates and Update Queue pages, and shows failed updates in red.
- Updates now always go through the update queue, one at a time per server, for every account. The Update Queue page shows every job live, with backup progress, and lets you cancel one job, a selection or everything waiting. Check it out
Blogged
- Vik Booking 1.18.19 is its third security release in a week, with fixes for Vik Rent Car and Vik Rent Items
- Phoca Download 6.1.6 adds the token check its file delete was missing
- StageIt 5.8.0 and 6.4.0 fix CSRF on every action, and a settings file that could run PHP
- PHP2Shell ModSecurity Fix Blocking WordPress and Joomla Saves on cPanel
New
- Filter All Your Sites to Not connected and a Reconnect all button reconnects every site in the list in one go.
- Save your table layouts to your account and restore them in any browser. A new browser picks up your saved layouts automatically. Check it out
- Stop or start uptime monitoring on lots of sites at once by selecting them on the Uptime page. Check it out
- Every keyboard shortcut is now listed on one searchable Keyboard Shortcuts page. Check it out
- Press Cmd+K (Ctrl+K on Windows) to search your sites, tools, tags, help pages, blog posts and changelog from one box, then press Enter on a site to pick what to do with it. Two-Factor Authentication settings and Support Requests are in there too. Read More...
- Pick which admin user Auto Sign In uses for each site from a searchable list, right on the Auto Sign In page. The site moves up into the sign-in list as soon as you choose.
Improved
- Anon Mode now uses realistic business site names and domains, and hides the PHP security release banner, so screenshots and demos look real.
- The Cloudflare page walks you through setup in three steps when you have no token yet, and shows each token as a card with its permissions collapsed. Check it out
- The changelog is now grouped by month and day, with blog posts in their own group. Check it out
- The Comfortable density on All Your Sites now draws bigger, easier-to-read rows.
- Audits, Backups and Uptime now use the same table as All Your Sites: search as you type, sort, group, show, hide and reorder columns, select many sites for bulk actions, and keep your filters when you refresh.
- On a phone, All Your Sites puts each site's tags on their own line, and the row menu has icons for Manage, Visit site and Admin login. Check it out
- Searching for login, sign in or wp-admin in the tool finder now takes you to Auto Sign In.
- Clearing the sign-in user on every site now asks you to confirm first.
- Auto Sign In has been rebuilt around signing in. Sites that sign you straight in are listed first, the search finds a site as you type, and Enter signs you in to the highlighted one. Generic sites are listed too, and the page works on a phone. Check it out
- Sites with lots of tags show the first two, shortened if needed, plus a +N pill that lists the rest.
Fixed
- Tags coloured with a name like yellow now get dark text, so you can read them.
- Auto Sign In on a site that isn't connected, or is disabled, now opens its login page instead of failing.
- On a phone, picking a filter from the menu on All Your Sites now closes the menu.
- The Health, Manage, Alert and Activity menus on Manage Site no longer close again as soon as you click them.
New
- Press F, or the new button at the end of the table toolbar, to make All Your Sites fill your browser window. Esc puts it back. Check it out
- Create a tag with its colour and left menu setting straight from your sites list, or from the + beside Site Group Tags in the left menu.
- When any of your sites are hacked, a red Hacked button on your sites list shows just those sites.
- Your sites list has been rebuilt. It loads straight away, filters as you type, and lets you group, sort and drag the columns into your own order. Fit keeps the table inside the window, Page scrolls the whole page. Check it out
- New MCP tool set_cloudflare_setting turns Always Use HTTPS, Development Mode or Managed robots.txt on or off for a site's Cloudflare zone.
- Purge Cloudflare Cache button in the site header, next to Admin Login.
- Sites on SiteGround now reconnect on their own. When SiteGround's Anti-Bot AI challenges us, mySites.guru passes its captcha automatically, so audits, backups, updates and connection checks keep working without a support ticket. Read More...
- Connector requests (audits, backups, updates and snapshots) are now cryptographically signed with Web Bot Auth, so a firewall that checks signatures can confirm they really come from mySites.guru, whichever IP they arrive from. Check it out
- A public page now explains every request mySites.guru makes to your sites: the User-Agents, the IP addresses, what each request does and how often, and how to verify or allow it. Both User-Agents link to it, so your host can look us up straight from a log line. Check it out
Improved
- The Vulnerable Plugins count in the left menu now shows how many vulnerable extensions you have across all your sites, not how many sites have one.
- The contact page has one search across help, recent changes and common questions, and now answers whether mySites.guru is GDPR compliant. Check it out
- The left menu is tighter, and the page you're on stands out.
- The tools page is now a table, and the search finds NEW and BETA tools too. Check it out
- Find a tool now sits next to search in the header, with the number of tools beside it. Check it out
- Switch site list badges on and off from the Badges menu on the list itself. Your choice is saved to your account, so the site header follows it too.
- Backup, Snapshot and Audit on your sites list now show how many sites you've selected, and ask before they queue anything.
- Cloudflare settings now sit in the Snapshot tab. Switch Always Use HTTPS, Development Mode and Managed robots.txt on or off from their rows, and change Security Level or Minimum TLS from the Investigate page, which also says what we recommend.
Fixed
- Some entries on this changelog showed a grey badge instead of their New or Fixed colour.
- Sites on SiteGround - Sorted. Phew.
- The API's core_update_available now matches the dashboard. It no longer stays true after a site is updated to the latest Joomla, and it now works for WordPress sites. A new core_latest_version field tells you which release a site should be on. Thanks Sander! API docs
Updated
- Our User-Agent is now
mySites/6.0 (+https://mysites.guru/bot/)for every request, including uptime checks. The old uptime User-Agent was not valid under the HTTP standard, and some host firewalls blocked it. The mySites/ part is unchanged, so firewall rules that match on it keep working. Thanks Rory! Check it out - Our User-Agent strings have changed. Requests to your sites (audits, backups, updates, snapshots) now send
mySites/5.4 (+https://mysites.guru/bot/), and uptime checks sendMozilla/5.0+(compatible; mySites/1.0; https://mysites.guru/bot/). The mySites/ part is unchanged, so firewall rules that match on it keep working. A rule that matches the old full string needs updating. Check it out
Improved
- The JCE Hack tool is now called Rogue JCE Editor Profiles and reports only rogue JCE editor profiles. Backdoor or dropper files found in upload folders can come from any exploit, not only JCE, so they now point you to the Hacked Files and Suspect content tools instead of being labelled a JCE hack. Detection is unchanged and hacked sites are still flagged.
New
- Audit many sites at once: the new Audit button on your sites list queues a full audit for every site the list is showing, so filter or search first to audit just some. Audits start 10 a minute, one at a time per server, and sites already being audited or not connected are skipped. Thanks Steph! Check it out
- Hosts that back-port PHP's 21 October 2026 fix without changing the version number no longer leave your sites flagged. Mark the PHP build and web host as back-ported on the PHP security release page, or from the site's Important card, and every site on that exact build counts as patched, with a shield on its PHP pill. Check it out
Improved
- Check for JCE Rogue Profiles & Backdoors no longer implies JCE was the way in when it only finds backdoor files. Other exploits, such as YOOtheme Pro before 5.0.53, drop files in the same places, so on a site without JCE the tool now says JCE was not the entry point and tells you to update the vulnerable extension instead. Thanks Ralph!
Fixed
- "Delete all monitors" now also removes the uptime monitors on sites where Pause Automated Checks is switched on. Before, it skipped paused sites and left their monitors running. Check it out
New
- Click a vulnerable extension, core CVE or Joomla 3 patch badge on the sites list to show every site with the same problem.
- New snapshot check: PHP Session Upload Progress Setting reports session.upload_progress.enabled, the stopgap most often suggested until your host applies PHP's security fix.
Improved
- The PHP In Wrong Place audit check now also scans YOOtheme Pro's image cache folders (/media/yootheme/cache and /templates/yootheme/cache), where the recent YOOtheme Pro attack wrote its files. Read More...
- Long site names on the sites list now end in an ellipsis instead of pushing the row wider. Hover the name to see it in full.
- Sites list rows are narrower. The vulnerable extension, core CVE and Joomla 3 patch badges now show an icon and a count, with the detail on hover, so the list fits on screen without scrolling sideways. Check it out
- API and MCP site summaries now include php_security_release, and an affected site counts as needing attention.
Fixed
- WordPress plugin and theme updates started through the API or the MCP tool now run. Before this they reached your site without naming the plugin, so nothing was updated even though the update history said it had been.
Updated
- The PHP security release alert now names the version that fixes it (8.5.12, 8.4.27, 8.3.36 or 8.2.35), and the host request asks your host to confirm any backported fix. End-of-life PHP branches say there is no official fix. Check it out
Security
- PHP versions missing PHP's 21 October 2026 critical security release (CVE-2026-109618, CVE-2026-109619) now show red, with an alert on each affected site's Important tab, a "Copy request for your host" button, and a new page listing which of your sites still need the fix. Check it out
New
- The Server Requirements check and its live Recheck now cover Joomla 1.5 to 3 sites as well. Check it out
- Recheck a server's PHP requirements live from the Server Requirements page or the snapshot row, so you can confirm your host's fix without waiting for the next snapshot.
- Server Requirements: every Joomla 4+ and WordPress snapshot now shows whether the server has the PHP extensions and php.ini settings your CMS needs, plus best practice ones such as curl, and says which kind each one is. Check it out
Improved
- The Important tab now warns when a server is missing a required PHP item or curl, with a request you can paste straight to your host.
Fixed
- Sites upgraded from Joomla 5 to 6 no longer get stuck on "connector upgrade failed". mySites now recognises the Joomla 6 connector, corrects the site's version and carries on.
- Joomla 4, 5 and 6 sites no longer disconnect during a snapshot when the Local filesystem plugin still has its original single-folder setting.
- Joomla 4, 5 and 6 sites now show the right version for installed languages. Sites upgraded from Joomla 3 were showing the old 3.x version, and fresh installs showed none.
- Installing an extension from an uploaded file no longer ends on an error page after it installs, and the uploaded package is now deleted afterwards.
- Remote installs that fail with "Could not download package from URL" now tell you when a missing curl extension is the cause.
New
- New snapshot check for Joomla, WordPress and Generic sites: MySQL Or MariaDB Database Server End Of Life.
- Sites on an end-of-life MySQL or MariaDB server now show a red database badge in the sites list, or amber when end of life is under 90 days away. Hover it to see when support ended and which LTS release to ask your host for. Type db-eol in the sites search to list them. Check it out
Improved
- Site data from the API and MCP now includes db_support_status and db_eol_date.
- PHP badges now follow the published end-of-life dates: red once a PHP version is out of support, amber in its last 90 days, with a popover giving the date.
- The daily reminder of sites still down now groups your sites by server and links straight to the setting that turns it off. Check it out
- When an uptime check times out, we now tell you plainly that this is almost always your web host blocking our uptime monitor (165.227.239.229) while your site is up for everyone else. The Uptime tab, the Important tab, the Uptime Monitor List, the alert and reminder emails and your uptime webhooks all say so, with a ready-to-send message for your host. Thanks Marcin! Read More...
Fixed
- The Uptime Log For Period table in client reports now fills in the Type, Date and Reason columns, which were showing blank.
Security
- Audits now flag the fake Cloudflare "verify you are human" captcha (ClickFix) as hacked when it is injected into WordPress core or theme files, instead of only listing it as suspect content. Thanks Nick!
Updated
- mySites.guru now runs on PHP 8.6 (Release Candidate 3), on both the dashboard and the background workers that talk to your sites.
New
- The API and MCP site data now include cms_lifecycle and cms_eol_date for every Joomla site.
Improved
- Joomla 5 now shows as security only. Joomla stopped bug fixes on 13 October 2026 and stops security fixes on 12 October 2027, so Joomla 5 sites get a yellow version badge, a countdown on their Important tab and a new Security Only Joomla filter. Check it out
Fixed
- Joomla 4 sites now show as end of life (Joomla stopped all fixes on 14 October 2025) instead of just out of date.
New
- Template Override Tracking: shows whether Joomla's Installer - Override plugin is on, and lets you switch it. Without it, Joomla records nothing when an update changes your overrides.
- Template Overrides To Check: see which Joomla template overrides an update has changed, compare each one with the new Joomla core file, edit it and mark it checked, all without logging in to the site. Thanks Jaz! Check it out
Fixed
- Joomla core updates and installs from URL run by mySites.guru are now recorded in Joomla's list of template overrides to check.
- On servers where the site lives in a short root folder such as /web, audits could show a file with part of its folder or file name missing, and mySites could not open or delete it from that path. The connector now only removes the root from the start of a path. Run a new audit to refresh the file list. Thanks Erik!
New
- Joomla 5.4.10 Released!
- Joomla 6.2.0 Released!
Improved
- Realtime site alert emails have a new layout. The subject now says what happened and where, like "Super Admin login on example.com", the details sit in labelled rows, and one button takes you to the right place in mySites.guru. They no longer link to your own site, which helps them past strict spam filters.
Updated
- Updated Blog Post: AcyMailing 11.1.1 fixes the vanishing Joomla update site. Its manifest now declares the update server and Joomla's Rebuild keeps the licence key, but sites that already lost their AcyMailing update site still need 11.1.1 installed over the top once. Read More...
Blogged
- JCH Optimize 9.4.0 Fixes Six High-Rated Security Issues in the Joomla Extension. Updated 10 October: JCH Optimize 9.4.2 is a second security release, which the vendor withdrew and rebuilt the same day with the same security fixes. Update every site to 9.4.2, including sites already on 9.4.0 or 9.4.1; Joomla 4.4 sites now need Joomla 5 first.
- OrdaSoft Simple Membership and Touch Slider for Joomla: Two Flaws That Need No Login
New
- WordPress 7.1.3 Released!
New
- Feature Requests: suggest a feature, see what other mySites.guru customers have asked for, and back the ones your team would use. When we say no, we'll say why. Check it out
Improved
- The API Credentials page now explains that Joomla gives a user a new API token the next time their account is saved, and how to keep a user without one (save once, then set Active to No). Read More...
Fixed
- File change alerts no longer repeat on every page load when the connector can't update its record of the watched file. Repeat alerts for the same file are now limited to one an hour.
Removed
- The Joomla connector no longer adds a "connector auto-upgraded" entry to your site's User Actions Log. Thanks Marcin!
New
- AcyMailing sites now get a warning when Joomla has lost AcyMailing's update site, which leaves AcyMailing looking up to date whatever version it runs. It shows on the Important and Updates tabs and says how to get the update site back. Read More...
- Every Joomla API token holder and WordPress Application Password on a site now has its own page, API Credentials in the Manage menu, with a revoke button on each one.
Fixed
- WordPress API login alert emails now show hidden text-direction characters in a username, so a disguised username can't pass for a real one.
- The WordPress 7 compatibility tool no longer says WordPress 7.0 needs MySQL 8.0 or MariaDB 10.6. The minimum is still MySQL 5.5.5.
New
- Joomla 3 Security, a new mySites.guru site at joomla3security.com: the Joomla 3 end-of-life dates, every vendor's Joomla 3 position with dated statements, the 39 core vulnerabilities Joomla never patched for 3.x, and how mySites.guru patches them in one click. Check it out
Improved
- The Joomla 3 patch tool's Learn More page now lists every security issue it closes and shows each site's live patch status. Learn more
Fixed
- Keyboard shortcuts no longer fire while you type in a search or filter box, so typing a word into the Activity filter no longer jumps you to another page. Thanks Nick!
Security
- The one-click Joomla 3 patch tool now patches 14 more core security fixes, 85 files in total, including the full Joomla 5.4.9 batch. Every fix is verified against a real Joomla 3.10.12 install. Check it out
Blogged
- 1,000+ Days After Joomla 3's End of Life, Everything You Need Is on One Site
- What Is MariaDB and Why You Have Probably Never Heard of It - but Use It
- 14 More Joomla 3 Security Fixes, Each Tested on a Real 3.10.12 Site
- Snapshot vs Audit: Settings Check or File Scan?
- SP Page Builder's Joomla 3 Security Patch Was Incomplete. Version 1.0.3 Fixes It.
Improved
- Mass Update Core Versions now follows your update queue: with the queue on it says sites update one at a time per server, and sites waiting their turn show as Queued on the progress page. Thanks Julian! Check it out
Fixed
- The Uploaded Tmp Files check no longer counts a folder in your site root whose name starts with tmp (such as /tmpl) as files inside your tmp folder. Thanks Erik!
September 2026230 changes
New
- Get an email when a Joomla or WordPress core upgrade fails, and optional desktop notifications when one finishes or fails. Check it out
Improved
- On the Manage Site Important tab, the "Joomla is out of date" or "WordPress is out of date" warning now comes first, so the upgrade you need to do is the first thing you see. Thanks Andreas!
- The Joomla and WordPress core upgrade progress page is rebuilt. It shows the real download and extract percentages, each Joomla upgrade stage as it happens, and if an upgrade fails, the stage it stopped at and your site's reply. Close the tab mid-upgrade and Manage site shows a View progress link to get back to it.
- The backup status window now updates live as each stage completes, and the Previous Backups list refreshes itself when a backup finishes, even if you closed the window.
Fixed
- Scheduled Akeeba backups can now be enabled on WordPress Multisite networks where Akeeba Backup is network-activated. Previously they failed with "Akeeba not installed" even though the snapshot showed it installed. Thanks Stephan!
- The core upgrade extract progress bar no longer shows as full from the start, and the progress page no longer gets stuck on "Checking the current status".
Blogged
- Quix Page Builder 6.3.4 Fixes Guest Access and Editor Code Execution Flaws
- AcyMailing Shoots Itself in the Foot With a Vanishing Update Site
- OS CCK 8.3.16 for Joomla Fixes a No-Login PHP Upload and an SQL Injection, but the Updater Still Offers 8.3.14
- JCTables for Joomla: Unauthenticated SQL Injection Fixed in 1.21.1
New
- Joomla 5.4.9 Released!
- Joomla 6.1.4 Released!
- Revoke every API key after a hack. Pick a site to see who holds a Joomla API token or which WordPress Application Passwords exist, then revoke them all in one go. On Joomla 5.4+ it can also replace the automated updates key, and on both it can log everyone out. The result shows what your site reports afterwards. Check it out
Improved
- Switch each Joomla API (Web Services) plugin on or off from its own row, so you can keep Joomla Update running and everything else off. API token holders now show as a table. Check it out
Fixed
- The Joomla API page no longer says the Joomla Update web service is "Not installed" on sites that have it.
Blogged
- Joomla 5.4.9 and 6.1.4 Fix 16 Security Issues, Two Rated High
- How to Disable the Joomla API (and What Breaks When You Do)
- How to Revoke Every WordPress Application Password After a Hack
- How to Revoke Every Joomla API Token After a Hack
- How to Delete a Site From mySites.guru
- Balbooa Forms 2.4.3.4 Fixes Five Security Issues
Improved
- Uptime Monitor webhooks now support Google Chat. Paste a Google Chat space's webhook URL and the format is picked for you. Set it up
Fixed
- The sites list no longer shows a false 'update available' badge when the only pending item is a Joomla core update. Thanks Clive!
New
- Uptime Monitor alerts can now be sent to any webhook URL. Pick Slack-compatible (works with Mattermost and Rocket.Chat too), Discord, Microsoft Teams, or signed JSON for n8n, Zapier and Make. Set it up Thanks Stefan!
Fixed
- The Slack integration's "send a test message" link now tells you whether Slack accepted the message, instead of always reporting success.
Improved
- On a phone, the Check for updates by-plugin page now shows the site preview and admin login links for each site, and its buttons fit on the screen. Thanks Adi! Check it out
Fixed
- A backup that stalled partway through, usually because we restarted our servers, is now picked up and resumed automatically within about two hours instead of sitting on Running.
Security
- Sites running the free edition of OS Gallery, which reports versions such as 6.2.5 Light, are now checked against OS Gallery vulnerabilities. That version format could not be read before, so those sites were never flagged. Read More...
New
- A new API endpoint and MCP tool give you a one-call overview of every site: versions, last snapshot, audit and backup times, cached update and vulnerability counts, SSL expiry, and a needs-attention flag with the reasons. It reads data we already hold, so nothing contacts your sites. Check it out
Improved
- The extension pages that list your sites, including "Similar to", now sort them A-Z, the same order as your site list. Thanks Frédéric!
Fixed
- The API docs no longer list pagination and filter options that the list endpoints never supported. Check it out
Security
- Sites running EasyStore below 3.0.1 are now flagged as vulnerable (seven flaws found by mySites.guru, including an unauthenticated customer data exposure). Read More...
New
- WordPress 7.1.2 Released!
- The Recent Audits list now shows how long each audit took. Check it out
Improved
- New 2FA setups now show as mySites.guru in your authenticator app, replacing the old myjoomla.com name. Existing 2FA logins keep working as they are.
Fixed
- An audit that was killed, retrying, upgraded or waiting on a connector upgrade showed a Queued badge on the Recent Audits list, so it looked like it had never started. It now shows its real status.
New
- If you pay £5 a month for one site, you can now upgrade yourself to the £19.99 Unlimited plan from your account. You see what you will pay today before you confirm, which is only the difference for the rest of this month, and your monthly payment date stays the same. Adding a second site now takes you straight to that quote.
Fixed
- Scheduled snapshots fell behind over the weekend while we were optimising our background workers, so some sites went more than two days without one instead of every 12 hours. That is fixed, and the overdue snapshots are catching up now, oldest first, over the rest of today.
Improved
- The vulnerable extension alert now names the version installed on your site alongside the version to update to, and says how recently the check ran.
- Vulnerable extension alerts now arrive within seconds of the check that found the problem, instead of waiting for the next morning's digest. If you have already patched something, you no longer get an email telling you to patch it. Thanks Julian!
Fixed
- A backup that failed partway through could show as Complete with no error message, so it looked like a successful backup in your list. Those now show as failed, with the reason your site gave.
Improved
- Site lists across the app now sort names the way you read them. A name that starts with an accent sits under its own letter rather than after Z, lowercase names are no longer pushed to the bottom, and Site 2 comes before Site 10.
- Check for updates now waits until every site has answered, then shows the whole result at once in A to Z order. On the by-plugin page the sites under each update are in name order, and on the by-site page the updates under each site are too, so applying one update across a lot of sites is a list you can work down. While the check runs you get a progress ring, a count of the updates found so far, the names of the sites still to answer, and a Show results now button if you would rather not wait. Sites that could not be checked are named at the end. Thanks Frédéric! Check it out
Fixed
- Your public links page was hiding any site that shared a name with another of your sites. All of them are listed now.
Security
- Joomla sites running JoomGallery 4.0.0 to 4.4.1 are now flagged for CVE-2026-84048, an unauthenticated file upload fixed in 4.4.2. Note the CVE record names 4.4.1 as the fix, which is itself affected. See the advisory
New
- Account owners on the £19.99 monthly plan can now switch to annual billing themselves and save £39.89 a year before VAT. The page works out exactly what you pay today, which is the annual price less the unused part of this month, and your annual year starts the day you switch. You will find it on Payments & Plans, in Cmd+K, and in a banner at the top of the page that you can hide for 30 days. Check it out
- Hide the Needs Attention and Information rows you never use in your left menu, and drag either section into your own order. Starred Tools now keeps the order you give it instead of sorting alphabetically. Check it out
Improved
- Our IP addresses now sit at the top of the Service Information page, above the search, because they are usually what you went there for. The page also links our Data Processing Agreement, Our Approach To AI, Cyber Resilience Act and Security pages. Check it out
- When an audit, a backup or a reconnect fails in a way that usually means a firewall is refusing our address, the error and the audit failure email now link our IP addresses, so you have something to send your host. Check it out
- Press / on a Manage Site page to jump straight to the Filter box.
Fixed
- Some browsers were filling your username into the Filter box on the Quick Snapshot and Full Audit tabs, which then hid every check on the page. That box is no longer mistaken for a login field, and nor is the one on the File Manager Access page.
New
- The Extensions tab has the same Filter box, so you can pick a plugin or a developer out of a list of hundreds.
- Find a check without scrolling: the Quick Snapshot and Full Audit tabs have a Filter box that narrows the rows as you type and highlights the match. Thanks Adi!
- WordPress 7.1.1 Released!
- New Starred Tools Menu and Your Portfolio Menu settings let you rename, reorder and unstar your starred tools, with Undo, and hide the rows you don't use. Check it out
- Rename any row in your left menu, in Your Portfolio, Needs Attention, Starred Tools and Information, to something shorter or clearer. A renamed starred tool shows its new name in Cmd+K too, and its original name still finds it. Thanks Laurent! Check it out
Improved
- The same page now checks what you type before it stores it, so a mistyped billing or downtime address, an SSL warning day count that is not a number, or something that is not an IP address is refused on the spot with the reason beside the box. Each panel also gained a Restore defaults button, Escape puts a box back to its saved value, and hiding a left menu row now updates the menu straight away. Check it out
- Your notifications, settings and preferences now save the moment you change them, so the big Save button is gone. Flick a switch and it is saved; type in a box and it saves when you leave it or press Enter. Check it out
- Clearer names for three left menu rows: SSL Cert Invalid, Support Requests and Current Service Issues.
Fixed
- Long names in your left menu no longer push the rest of the menu around when you hover them. If a name is cut off, hover it or tab to it to see it in full. Thanks Laurent!
- The Remove Generator Tags tool no longer conflicts with page builders such as Breakdance, where it could stop the builder's CSS reaching the page and leave the front end completely unstyled. Thanks Kyle!
- The Site Activity Log section of your scheduled client reports was showing an error on Joomla 5 and 6 sites since 14 September. None of that activity was lost, so you can recover the missing days by re-running a report over a specific date range. Thanks Michel! Check it out
New
- Browse All Tools has a new filter beside the search box: All, Starred, Joomla, WordPress and Universal. Pick a platform to see just its own tools. Browse all tools
- Click a scheduled event's name to read the code behind it.
- Your audit now counts and sizes every cache folder, shows what is filling them, and lets you empty each one. Joomla core and FOF extensions like Akeeba's write to different folders, so each is counted and emptied on its own.
Improved
- The tool list, Cmd+K and keyboard shortcuts now show only the tools for platforms you have sites for, so a WordPress-only account stops seeing the Joomla toolset. To see everything, turn on "Show tools for every platform" in your preferences. Open preferences
- The sitemap check can now tell a blocked sitemap from a missing one. A server that answers 403 Forbidden for your sitemap now gets a Blocked badge saying the file is there and something is refusing it, and Google is getting that same refusal. Where your server refuses every .xml request, we now say we could not check rather than telling you that you have no sitemap.
- Recorded 404 URLs lists 500 at a time, so selecting the whole page and pressing Delete selected now works in one press. The cap was 200, which left the button greyed out on a full page.
- The Text Filters panel lists Public, Registered and Guest with the setting each one actually holds, instead of saying one or more of the groups needs attention. Check it out
- The Force Multi-Factor Authentication For Super Users check now explains why it only appears on Joomla 6.1 and newer. Joomla could force MFA per group from 4.2, but the Super Users group could not be picked from that list until 6.1. The check has been gated to 6.1 since June; the changelog entry announcing it said 4.2.
Fixed
- Exporting your extensions as CSV from a WordPress-only account now gives you your WordPress plugins. Joomla and WordPress each have their own export.
- 58 checks exist on both Joomla and WordPress under the same name, and the WordPress version of each was missing from the tools page and Cmd+K. Both versions now appear.
- WordPress sites: we now look for your sitemap at /wp-sitemap.xml, which WordPress has published by default since 5.5 and which we had never checked. If yours lives there, it will start showing as found instead of missing.
- The backups tab now recognises Akeeba Backup Core, the free edition, on Joomla 4, 5 and 6. Akeeba Backup 9 gives both editions the same description, so most sites running Core never got the warning that our backups need Akeeba Backup Professional.
- On Joomla 3 and 4 that same missing entry made the fix button stop the connector mid-write on PHP 8, and on PHP 7 invent a configuration shape your site never had. It now writes the three values Joomla's own installer ships.
- A red badge on "Set Public, Guest And Registered Groups To 'No HTML'" could not be cleared on Joomla 5 and 6. Where one of the three groups had no saved Text Filters entry at all, Investigate showed a green "Recommendations Applied" over the red badge, and the fix button wrote your configuration back unchanged and reported success. It now creates the missing entry. That has been the case since January 2024.
New
- New per-site option to clear an Akeeba Admin Tools block of our IP automatically after each snapshot. Off by default, under Config, Advanced.
- When Akeeba Admin Tools blocks our IP, the Backup tab now says so and gives you a button to clear it. The fix reaches your site even while the block is active.
- Processes Running Deleted Code, a new check on Joomla, WordPress and Generic sites. It finds a PHP process still running code you already deleted, which is how a site gets rewritten seconds after a clean. Every other check reads your files or your database; this one reads memory. Beta, and where your host blocks the read we say so rather than showing a green tick.
- The sites list can select by tag. Tick the sites you want and apply or remove a tag in one press, from the sites list header. The mass upgrade and remote install pickers can select by tag too, which both already searched on tags without saying so. Check it out
- Tags can now be put in the order you want. Drag them in the left menu, or on the tags page, and that order is what you see everywhere. They were alphabetical with no way to change it. Check it out
Improved
- The login greeting now draws you your own robot if you have no Gravatar, instead of the grey silhouette.
- Sign in with a passkey without typing your username first. Your browser offers the right passkey and we work out who you are from it.
- The login page now shows only the sign-in method you used last time, with a link to switch to the other one. A rejected sign-in brings both back.
- File paths on the Impostor Plugin Identities, Malicious WP-Cron Events and Must-Use Plugins panels are now links. Click one and the file manager opens on the folder that file sits in, so you can see what else was dropped beside it.
- New rogue administrator patterns on Joomla and WordPress, catching more planted admin accounts.
- Impostor Plugin Identities now also flags a WordPress plugin that is a single PHP file in a folder with no readme, a shape a genuine plugin almost never has.
- The public release tracker prints the Joomla to WordPress ratio alongside the release counts. Check it out
- Tag colours in the left menu are a filled swatch rather than coloured text, so a very pale or very dark tag colour stays readable in both light and dark mode.
- The tags page no longer reloads. Add, edit and assign open in a dialog and the table updates in place. Assigning sites used to load a whole page listing every site you own, which was slow on a tag with hundreds of them. Check it out
Fixed
- Tool titles now always spell the brand correctly as mySites.guru. Title-casing was capitalising its first letter on the Snapshot tab, the Audit rows, the Tools page and the sites list.
- A backup that finished with warnings is no longer described as having errors on the Backup tab.
- A backup refused with a 403 no longer suggests disconnecting and reconnecting your backup plugin. That cannot lift an IP block, and it threw away your Akeeba secret to find out.
- Sites where we have never read the Admin Tools status no longer show a green tick saying it is not installed. We do not know that, and now we say so.
- An Akeeba Admin Tools IP block stops your backups and nothing else. We were telling you it also broke your audits, snapshots and updates, which was wrong.
- The activity log purge options now say what they do. "Only the entries mySites.guru wrote" matched four housekeeping phrases and left the rest behind, so there are now two options that each name exactly what they remove. The dated purge shows the oldest entry rather than the table size, and declines to open a confirm when nothing is old enough to go.
- A connector upgrade could report success having replaced nothing, on hosts that reset our files to read-only. The site then asked to upgrade again on every request, which fills your action log. The upgrade now reads back every file it wrote and says which ones failed.
- The cog on the Tags heading in the left menu did not open the tags page, it armed drag mode. The heading now has two controls, one to reorder and one to open the page.
- A team member restricted to a few sites could take every other site off a tag by saving the assign dialog. They saw only their own sites in it, but the save removed everything it had not been told about. A restricted member can now only add and remove within the sites they can see.
- Assigning a tag to a very large selection silently dropped the tail. Past roughly a thousand sites the browser sent more form fields than the server accepts, so the save arrived cut short, removed the sites it never received, and reported success.
Blogged
- T4 Page Builder 2.3.0 Fixes an Unauthenticated Mail Relay
- J2Store 3 Stops Getting Security Fixes on 19 October 2026
- Regular Labs Publishes 24 Joomla Extension Updates Including 10 Security Fixes
- Six more J2Store flaws fixed in 3.3.23, 4.0.23 and 4.1.8
- Five New Checks for WordPress Hacks a File Scan Cannot See
- A Backdoor Hides in Joomla's Scheduled Tasks Table
- Tag Your Sites by Client, Server or Retainer
New
- WordPress accounts can hold an application password or a WooCommerce API key: a second way into your site that keeps working after you change your password. A new tool lists every one, shows when it was created and last used, and lets you revoke anything you do not recognise. Check it out
- Every Search Engine Visibility tool now has an Edit robots.txt button. It opens the file your site is serving right now, warns you before you type if yours is a site where editing the file on disk changes nothing (a CDN writing its own, an install below your domain root, or WordPress serving a virtual one), and warns again if what you are about to save would shut out Google, Bing or an AI answer engine. It still saves what you asked for. Check it out
- Joomla 3 sites can now install JoomShaper's SP Page Builder Joomla 3 Security Patch 1.0.2 from mySites.guru in one click, and a site still on patch 1.0.1 now reports as outdated instead of patched. Check it out
- Recorded 404 URLs counts the missing URLs the Redirect plugin has stored up, and gives you a page to read them and delete the ones you tick. It never deletes by rule, because that same table holds the redirects you built yourself. Thanks Adi! Check it out
- Redirect URL Collection shows whether Joomla is still recording every missing URL on your site, and lets you switch that recording off without touching the redirects you have already built. Thanks Adi! Check it out
- Joomla's System - Redirect plugin now has its own audit row, including the state that is easiest to miss: the plugin switched off while you still have redirects configured, so none of them fire. Thanks Adi! Check it out
Improved
- The Activity tab is now a real table. You can search it, filter by user, extension, IP address or date range, sort any column, page through it properly, and export what you are looking at as a CSV. It was a flat list of the most recent entries with no controls at all, and a footer that counted entries it was not showing. Check it out
- The Tools page lists its 261 tools as rows rather than a grid of cards, so around 22 fit on screen instead of six. Descriptions run in full rather than being cut off mid sentence, and the search marks the words it matched, so you can see why a row came back when the match was in its description. Check it out
- Recorded 404 URLs now sorts by how often each URL was hit, and a Delete all button clears the whole recorded list in one press. Your own redirects, rows you annotated and imports you have not finished stay where they are. A big table clears in batches so the job stays inside your host's time limit, so you may need a second press. Check it out
- Edge Managed Robots shows what your CDN changed as a red and green diff. It used to print both copies of the file and leave you to compare them line by line. Check it out
Fixed
- Disable Application Passwords was showing a green tick on sites where we could not actually tell, because that reading depends on how our own request reached your site. It now says when it could not determine the setting.
- Each Investigate page now shows when its own reading was taken. All of them used to print the date of your last full audit, so on a monthly audit schedule a snapshot check taken that morning read as three or four weeks old.
- The red hacked banner now names the WordPress checks that raised the flag. A site flagged for a rogue administrator account or a malicious WP-Cron event used to get that red card with only an advisory row about suspect file patterns inside it. A check that has not reported yet has also stopped showing up there as a grey No Data row.
Security
- A marker file being planted on hacked Joomla sites this month is now caught by where it sits rather than what is inside it. The file is a working image, so every check that reads file contents was happy with it.
- Every connected Joomla site running SP Page Builder below 6.9.1 is now flagged as vulnerable. Five issues we found and reported to JoomShaper on 8 September, fixed in 6.9.1, now carrying six CVE numbers.
New
- Suspect WP Options now recognises the option names used by a malware family that keeps its payload in your database, including the ones hidden behind WordPress's own transient prefixes. Check it out
- Impostor Plugin Identities flags a plugin whose author and vendor domain look invented rather than real, which is how fake plugins planted on hacked sites usually present themselves. Check it out
- Must-Use Plugins and Drop-ins lists the WordPress code that runs on every request and cannot be switched off from wp-admin. Most of it is your host's, and the tool says which. Check it out
- Rogue and Hidden Administrators now runs on WordPress as well as Joomla. It reads your user table directly rather than asking WordPress, so it can show you an administrator account that your own Users screen has been told to hide. Check it out
- Joomla's own Scheduled Tasks are now read on Joomla 4.1 and above, and every task is checked against the task types your installed plugins actually register. Check it out
- Suspect WP Options is the wide net for the table that payload sits in. It flags oversized and machine-named rows in wp_options for you to judge, the same way Suspect Content does for files, and it never returns the contents of a row. Check it out
- WordPress Scheduled Events are now checked on every snapshot. A growing family of malware keeps its payload in your database and schedules a job to rewrite the files a few minutes after you delete them, which is why some sites reinfect themselves however carefully they are cleaned. Check it out
Improved
- Must-use plugins, drop-ins and suspect plugin folders are now clickable, opening the file manager at the right folder so you can read what is actually there. Check it out
- Rogue and Hidden Administrators lists accounts as a table with column headers, so you can see at a glance which value is the username, the email and the registration date. Check it out
- The Malicious Cron Jobs page now says plainly when there is nothing to worry about, instead of leaving you to infer it from an empty page. Check it out
- Running a Snapshot now re-reads your robots.txt, so the Search Engine Visibility tools show your edit immediately instead of up to 12 hours later. Thanks Adrian! Check it out
Fixed
- Suspect WP Options no longer reports a row as suspect just for being large. Caches, backup histories and WordPress's own permalink table are all legitimately big, so size is now shown for information, with the plugin it belongs to where we recognise it, and never counted as a finding. Check it out
- Scheduled Events no longer flags ordinary jobs from Yoast SEO, WPML, Jetpack and Mailchimp for WordPress. The check now looks at which plugin file runs an event before it looks at what the event is called, so a version number in a hook name is no longer treated as a clue. Check it out
Security
- A scheduled event we recognise as malware now marks the site as hacked. This is the loop that puts deleted files back within minutes of a cleanup, so it is treated as a compromise rather than a warning. Check it out
Removed
- The blue last-audit-not-viewed icon has gone from the sites list. It showed on almost every connected site and only ever meant you had not opened the newest audit yet, so it crowded out the badges that mean something: HACKED, disk critical, and the vulnerability and CVE pills.
New
- Hide the Snapshot and Audit checks you have decided not to act on. Click Edit rows on a site's Health tab to hide a single check or a whole section, just for you. The checks still run, a warning appears if a hidden check starts failing, and Show all brings them back.
Improved
- Hide OK on a site's Snapshot and Audit tabs now remembers your choice after a reload.
Fixed
- Health sections where none of the checks apply to your site's CMS version now say so instead of showing an empty card.
Improved
- The contact page now shows the time where Phil is. It had been showing UTC, an hour out all summer. It also lists the ten latest changes instead of three, and offers our PGP key if you want to encrypt credentials before pasting them in.
- The Audit tab has been redesigned. A running audit is now a checklist of its thirteen steps, ticked off live as your site reports each one, with an elapsed clock. The deep scan is the one step we can measure, so it keeps the only progress bar; the old bar's percentages were fixed widths that meant nothing. Queued, cancelled and failed audits share one clearer layout, and an audit waiting in the queue no longer says "Audit Starting".
Fixed
- WordPress sites running a theme with one stray non-UTF-8 character in its files (Grace Themes, for one) had stopped sending us their plugin and theme list, so the list froze on the day it first failed, and vulnerability checks kept testing the frozen copy. You could update a plugin and still be told it was vulnerable. The connector now repairs the text and sends the list.
- Audits on very large Joomla and Generic sites, VirtueMart shops with a big page cache especially, could run out of memory at the hacked filename step, get killed by the host and retry forever. That step now checks a few hundred candidate files where it used to pull in thousands, and its memory use stays flat however big the site is. Three hacked filename patterns that could never match before are now detected too.
- The "Your robots.txt Should Point Crawlers At Your Sitemap" check now tries the sitemap address your robots.txt names before guessing /sitemap.xml. Sites using OSMap, JSitemap or 4SEO, whose sitemaps live at other addresses, were wrongly told "No sitemap found on this site". A declared sitemap that does not answer now shows as a warning. Each site corrects itself at its next snapshot. Thanks Greg!
- The fix buttons on "Your robots.txt Should Not Block AI Answer Engines" and "Your robots.txt Should Not Block Search Engines" now send an unblocked crawler back to your User-agent: * rules, like every crawler you have not named. The first version gave it a group of its own, and a crawler with its own group ignores the * rules, so it was let into /administrator/ and every other folder your file keeps crawlers out of. If you used either fix before 11 September, look in your robots.txt for a crawler's User-agent line sitting over an empty Disallow:, or a block headed "Access restored by mySites.guru", and comment it out. Thanks Teddy!
New
- If a live connection does drop, from a laptop waking up or a network blip, the page now retries on its own and tells you when it cannot recover, with a Reload button, instead of appearing to still be working.
Improved
- The PHP Disabled Functions check now tells you which blocked function actually matters. It goes red only when your host has blocked something mySites.guru needs, and it names it. Orange means something is blocked but we work around it, green means nothing is. It used to show red for any blocked function at all, which was 45% of sites and told you nothing useful.
Fixed
- AI malware analysis verdicts on the Investigate tab now stream in as each file is analysed.
- Live progress on the audit tab, the update queue, mass upgrades, reports and RemoteSpy no longer stops partway through. Opening a second page used to quietly revoke the first page's live connection, which then sat there looking connected while showing nothing.
- Sites on a host that blocks the PHP function getmypid could install the connector and then never connect, and on Joomla the site itself could show a white screen. That was our bug, introduced on 4 September, and it is fixed. Since PHP 8.0 a function your host has blocked is a fatal error rather than a warning, so the connector died on its first request. We guarded set_time_limit the same way.
Security
- We now check for the security issues Digital Peak fixed on 10 September in DPAttachments, DPMedia and DPCases. None of these three had vulnerability detection before today. The one to act on first is DPAttachments: before 5.8.1, its front-end download link confirmed only that an attachment existed and never checked whether the person asking was allowed to have it, so unpublished files and files on restricted access levels could be downloaded by anyone. Update to DPAttachments 5.8.1, DPMedia 1.21.1 and DPCases 3.8.1. Any connected site running an older version is flagged now. Read the write-up
New
- Your Joomla and WordPress sites now have a Search Engine Visibility section on the Snapshot tab. We fetch your live robots.txt from our own servers and parse it properly, so we can tell you whether it shuts out every crawler, blocks Googlebot or Bingbot, blocks the AI crawlers that decide whether you can be cited in a ChatGPT, Claude, Perplexity or Apple answer, is reachable at all, sits where crawlers actually look for it, and names your sitemap. Blocking an AI training crawler costs you nothing in search. Blocking an answer crawler deletes you from that assistant, and in the file the two are one word apart.
- Every site now has its own robots.txt page. It shows the file annotated with what each rule actually does, the copy on your server side by side with the copy crawlers receive, a tester that answers whether a named crawler can fetch a given URL, and a recommended file already filled in with your own sitemap address. Google retired their own robots.txt tester in 2023.
- One page now lists every site whose robots.txt is turning search engines or AI assistants away, and puts access back on as many of them as you pick, in one go. Check it out
- We now email a site's owners when it starts blocking search engines or AI assistants, rather than every day it is blocked. A site you blocked deliberately years ago stays quiet.
- Your account page now shows your own recent sign in: when you last signed in, when you were last seen, and the IP address it came from. mySites.guru has recorded these for years and only admins could see them. Check it out
- Every set of credentials you have sent us now has a page of its own: what you sent, when it was sent, when it will be destroyed, and a button to destroy it now. While you have one open it sits in your sidebar under Open Support Requests. Check it out
- Joomla sites are now checked for whether the $secret in configuration.php is set, and whether it is at least the 16 characters Joomla generates for itself. Your site counts the characters and sends us only the number, never the secret itself. You can also rotate it from the same page, and the confirmation spells out exactly what that costs you. Check it out
Improved
- You can now turn the backup overdue email off. Until now it sent whether you wanted it or not, because there was no switch for it. Check it out
- The malicious cron job check now catches self-healing droppers: a job that copies a hidden PHP file back into your web root whenever it goes missing, so the webshell you delete is back within minutes. The job itself fetches no file and runs no code, which is how this shape stayed under the older rules.
- The sign in page recognises you. It greets you by name with your avatar, and if you used a passkey last time it says so under the passkey button. The Not you? button forgets the browser again.
- Both credential forms now ask what you actually want done. A perfect description of a white screen still leaves us guessing whether you want it diagnosed, fixed, or explained.
- The consultancy form no longer asks you to pick a plan. It shows the fee: £120, one fixed fee per incident, same-day resolution on average. Check it out
- The Sign In Alert email now explains two factor authentication and links straight to the setup page when your account does not have it, and every sign in alert now offers a password reset if the sign in was not you. Turn on 2FA
Security
- Credentials you send us are no longer emailed. They go into an encrypted store only Phil can open, and they are destroyed seven days after you send them, or once the work is finished if that takes longer, never past thirty days.
Removed
- The "Distributed robots.txt File Should Be Modified To Suit Your Site" check has gone. It went red on any site still serving Joomla's stock robots.txt, which is a perfectly reasonable file to serve. On their last audit more than 16,000 Joomla sites were sitting under that red badge. What it was reaching for is now covered properly by the Search Engine Visibility checks.
New
- Desktop notifications. Get told about backups, audits, downtime and security alerts in your browser, even when mySites.guru is not the tab you are looking at. Turn it on per browser, choose which events reach you, and send yourself a test. Check it out
Improved
- When a site tells us it has permanently moved, for example from http:// to https://, we now correct the address we have stored for it instead of following the same redirect on every call.
Fixed
- Akeeba Solo sites were being sent a Joomla-style address instead of their own remote.php, so they could not connect at all. They now get the right one.
- The backups panel now shows what your site actually replied. It used to say "Could not load backup profiles. Reconnect Akeeba" whatever the reason, which sent people to reconnect a plugin that was working perfectly.
- Akeeba backups now work on sites that answer a redirect. A site stored here as http:// that has since moved to https:// was losing the backup request on the way, so Akeeba answered "Invalid method" and nothing ran. We follow the redirect ourselves now and send the request intact. On a random sample of 150 connected Akeeba sites, about one in nine was affected.
Security
- Backup requests no longer inherit the previous site's settings. On a busy worker, one site's backup ID, profile and HTTP authentication details could be sent with the next site's request. Each site's request is now built from scratch.
- A redirect from your site to a different domain is no longer followed. Your Akeeba secret used to go with the redirect wherever it pointed; it now stops at your own domain, and a redirect that downgrades https to http is blocked too.
New
- The "One Webspace Should Contain One Website Installation" check now has an Investigate page. It lists every installation we found in your webspace: where it lives, whether it runs Joomla or WordPress, which version it is on, and how many files it holds. Check it out
- You can now set the timezone your CMS displays dates in from mySites.guru, without logging in to the site. It changes how dates are shown to you and your visitors, and never what is stored: Joomla and WordPress both keep every date as UTC regardless of that setting.
- Every site now has a Time & Timezone check, showing the timezone your server runs in, the timezone your CMS displays dates in, where your database sits relative to UTC, and whether the server clock has drifted away from real time. Find it on the Quick Snapshot tab under Joomla Configuration or WordPress Configuration. See it across all your sites
Fixed
- On WordPress sites this check was looking for a Joomla installation, so it never once reported a second WordPress install. It now counts Joomla and WordPress alike. Some sites will turn red for the first time, and those are real second installations we had been missing.
New
- Every date in the app is now hoverable. Hover or tab to one and a card shows that same moment in UTC, in your account timezone, in your computer's, and on the site's own server. Each row copies as ISO 8601, SQL, readable text or a Unix timestamp.
- Your account now has a timezone. Set it and every conversion card shows the time in your own clock alongside UTC. The picker searches by city name, and leaving it blank keeps you on UTC. Set yours
New
- Drag files from your desktop straight onto the File Manager to upload them.
- The File Manager can now pop out into a window of its own.
Improved
- The Universal User Manager list has been rebuilt, and it now recognises Super Admins.
- A blocked connector now tells you what happened instead of showing a raw error.
- Release Radar's public list is now paged, and its search looks across every release rather than just the page you are on. Take a look
- Copy link now gives you three links to choose from rather than one.
- The File Manager trash controls have moved into the toolbar, and the header is tidier.
Fixed
- AI analysis no longer fails with "model not available" when GPT-5 is selected.
- Akeeba Backup storage state files are no longer flagged as suspicious by the deep scan.
- Sites were sending alert emails their owner had switched off. We now check the site's own setting before anything is sent, and the causes of the two getting out of step are fixed.
- The File Manager spinner sometimes never stopped.
- Deleting a file sent you back to the site root instead of leaving you where you were.
- View trash did nothing, and Empty trash could be used from outside the trash.
Updated
- Our account terms have been updated. Two new clauses cover competitor replication and changes to the terms themselves. Read them
Security
- A site alert panel displayed a site's own URL without escaping it first, so a crafted URL could have injected markup into the page. It is now escaped.
New
- WordPress sites now support the full user manager. Browsing, creating, editing, deleting, password and role changes previously worked on Joomla only.
- Every site now has a User Manager tab. Browse that site's accounts live, and add, edit, block, unblock or delete them and change their group membership, without logging in to the site.
Improved
- The cross-site user search now finds a person on every connected Joomla and WordPress site at once, with last login and registered dates, and can change name, username, email and password across every site you tick in one action. Check it out
- The site API now returns every one-click tool that can fix a vulnerability, in a new remediation_tools field, because some issues have more than one fix.
- Vulnerability cards now name the one-click tool that fixes each issue instead of just saying "fixable now", and the link takes you straight to the right row on the Snapshot tab.
Fixed
- Force SSL is no longer reported as disabled on sites whose connector has never sent us that setting. Older connectors do not report it, and a missing value was being read as "off".
- The core vulnerability heading now counts only the issues still open on your site. A site that had applied every patch we ship was still told it was exposed to all of them, quoting the severity of one it had already fixed.
Security
- The Joomla 3 end of life patch now also fixes CVE-2026-48902, where password and username reset emails were sent as plain http links on sites not set to Force SSL "Entire Site". Re-apply the patch on your Joomla 3 sites to pick it up.
New
- Release Radar is live: a free public log of new Joomla and WordPress extension releases, including the paid ones no plugin directory covers, at releases.mysites.guru. Your own Release Radar narrows it to the software your sites actually run.
- You can now hide the time-on-mySites total from the left menu. Turn it off
- The sidebar now shows how long you have spent on mySites.guru this month, counted only while a tab is open and you are actually using it.
- Fix File & Folder Permissions attempts to set your files and folders back to safe permissions across a whole site, including the httpdocs or public_html folder itself that nothing else can reach, and tells you exactly what your server refused. Check it out
Security
- J2Store: we now check for five security issues we found and reported, all fixed on 31 August. The worst lets any Joomla administrator login, holding no J2Store permission at all, destroy the shop's data. Three release branches were patched at once, so your site page names the fix version for the branch each shop is actually on: 3.3.22, 4.0.22 or 4.1.7. See what we check for
August 2026171 changes
New
- File lists in Tools have a new Core Files First button that sorts modified core files to the top.
- The audit badges from the file manager now appear on the Tools file lists too. A file in Suspect Content that is also a core file whose bytes no longer match the CMS now says so, and clicking the red Modified Core File badge opens the diff against the original. Core File, Unmodified Core File, Hash changed and Suspect content all show as well. A site on an older connector shows a neutral grey badge until it upgrades, and never a misleading green one.
- You can now choose which badges appear on your sites list and site pages. A new Sites List & Badges section lets you hide the PHP version, CMS version, database version, server hostname, update counts, SSL countdowns, tags and more, or hide every badge at once. Hiding a badge is cosmetic only: your search filters, menu counters, alerts and the Important tab all keep working exactly as before. Thanks Stefan! Check it out
Improved
- The file manager now flags a file renamed with a .sorry extension as Ransomware, so an encrypted file stands out in the browser.
Fixed
- The Google links on your site's Google relationship report now open Google Search Console, having pointed at the retired Webmaster Tools dashboard. The email report's domain verification advice now names your own domain rather than a hardcoded one, and links Mailchimp's current help page.
- WordPress sites on PHP 5.6 and PHP 7.0 can be audited again. Modern syntax had quietly crept into our WordPress connector and raised the PHP version it really needed to 7.1. It is back on PHP 5.6, checked against a real PHP 5.6 interpreter, and a test now holds it there.
- The Vulnerabilities list no longer pushes the Published column off screen when a rule names nine or more CVEs. Each CVE now sits on its own line instead of one unbreakable row. Check it out
- Turning the file manager on or off no longer reports "That request was refused by your site" when your login has gone stale. It now asks you to sign in again. Your own site was never refusing anything. Thanks Peter!
- The phpcurrent and phpnotcurrent filters on the sites list now match every current PHP version. Previously only the first version in our list was ever checked, so sites on a newer PHP were wrongly reported as not current.
- Your custom "days before SSL expiration" setting is now honoured on the Extensions pages and on the Sites by SSL Expiration page. Both previously fell back to the 90 day default and ignored what you had set.
- Sites hosted with Crazy Domains were having our connector and Akeeba Backup calls blocked by their firewall, which rejects a request that arrives without a Referer header. We now send one, the same workaround we already use for 20i.
- GavickPro templates are no longer reported as hacked files. Their own update checker builds an hourly token by hashing your site secret five times, which is the shape our scanner looks for in a password-protected backdoor. We now recognise the updater by its own fingerprint, so a real backdoor dropped into a GavickPro folder is still flagged.
Updated
- File Manager now works on Joomla 3 and Joomla 4 sites, alongside Joomla 5, Joomla 6 and WordPress. Read More...
Security
- miniOrange free extensions: we now check seven of them for CVE-2026-78074, a missing authentication check that lets an anonymous visitor uninstall any extension on your site, not just miniOrange's. There is no fix released yet, so if you are not using the extension, take it off the site. See what we check for
- Helix Ultimate: five security issues were published on 31 August affecting every version below 2.2.10, among them a stored XSS in the Mega Menu and an image upload that accepted non-image files. Your site page now lists them. The template and the plugin install separately, so update both. See what we check for
- The one-click JoomShaper Joomla 3 patch now deploys Helix Ultimate security release v1.0.3, which closes an arbitrary file deletion we reported to JoomShaper on 27 August. Any user able to edit one article could delete images belonging to other people's articles. Joomla 3 sites on an earlier patch now show as needing an update.
Blogged
- What Site Audits Reveal About Joomla and WordPress Security
- Helix Ultimate 2.2.10 Fixes Twelve Security Issues, Including a Pre-Login Bypass
- Helix Ultimate's Third Joomla 3 Patch Since JoomShaper Said There Would Be None
- Finding Rogue Admin Accounts Across Every Joomla Site You Manage
- The latest 90 reviews of mySites.guru - and what they said
- Summer 2026: Everything New in mySites.guru
Improved
- When a folder listing comes from our cache rather than live from your site, it now says how old it is and offers a Refresh. On a site you are investigating, that difference matters.
- Browsing folders in the web file manager is much faster. Opening a folder now also fetches the ones inside it in the background, so your next click is usually instant instead of waiting on a round trip to your site. Check it out
Improved
- One click now switches off all three of Joomla's Guided Tours extensions: the system plugin, the component and the admin module. Previously only the plugin was disabled, which stopped tours running but left Guided Tours sitting in your System menu and on your dashboard. Check it out Thanks Chris!
Fixed
- The Guided Tours check no longer reports OK for a site that has never reported it, or where a duplicated plugin row made an enabled plugin look disabled. It now also warns when the component is switched off while the plugin is still running, which breaks tour dismissal on Joomla 5.2 and later.
New
- You can now hide the core CVE and vulnerable extension badges from your sites list. Two new switches sit under Settings and Preferences on your notifications page. Hiding is cosmetic only: your sites are still scanned, the filters still find them, and your alert emails are unchanged. Check it out
Improved
- The information page you can hand to a web host now explains uptime monitoring properly: the IP our checks come from, the five minute schedule, and the fact that a check on a healthy site is a single HEAD request that never touches PHP or your database. It also lists the exact user agents we send, so a host can identify our traffic in their access log. Check it out
- The Joomla 5, Joomla 6 and WordPress 7 compatibility pages and the Theme and Template list now load a fraction of the data they used to, so they open much faster if you manage a lot of sites. Check it out
- The JoomShaper patch tool now names which patch release each extension is running, and tells you honestly when a deployment fails instead of reporting success. Previously a failed download or a checksum mismatch both looked like a successful patch.
- The vulnerable extension and core CVE badges in your sites list are now clickable and take you straight to the site. A site with one CVE also now reads "1 core CVE" instead of "1 core CVEs".
Fixed
- Deleting a site no longer stops that minute's scheduled snapshots from running for the rest of your sites.
- Joomla 3 sites that already had JoomShaper's earlier Helix Ultimate patch applied were showing as fully patched when a newer patch was available. They now correctly show that an update is ready to deploy.
- Webhost disk space warnings now respect your preference everywhere. If you had switched them off, they were still showing on the extension detail pages.
Updated
- Our security policy now names the uptime and utility hosts as in scope for vulnerability reports, links our Cyber Resilience Act statement, and explains that the connector's payload cipher is not what authenticates a request. Check it out
- The "Patches Available" badge in your sites list now follows your End Of Life Version Warnings setting, so switching that off hides this badge too.
Security
- Joomla 3 sites running Helix Ultimate are now offered JoomShaper's latest security patch, which adds real image-content validation on uploads, hardens media path handling against traversal, and enforces per-item permissions on mega menu changes.
New
- Connecting a site that another mySites.guru account still holds no longer stops with an error. Install the connector as usual and, once we have checked with your site that it really is yours, the domain moves to your account and the connection finishes on its own. The previous account holder is notified and can reply to us if anything looks wrong. Connect a site
Improved
- Adding a site you already manage now reconnects it in place and keeps all of its history, instead of refusing because the site is already in our database. This is what to do if your connector has stopped matching and needs reinstalling.
Fixed
- Updating an extension yourself no longer emails you. You are already watching it happen, so only the scheduled auto-updater sends mail now.
Improved
- Site lists, tools, backups, updates and audits load faster on accounts with a lot of sites. Each page was fetching and decrypting several credential columns it never used, and doing a separate cache lookup for every site's tags.
Fixed
- Auto sign-in now honours a WordPress subfolder install. It always sent you to /wp-admin/ at the domain root before, so a WordPress site installed in a subfolder went to the wrong place.
- Directory-protection passwords containing a space, or any of @ : / ? #, now work with auto sign-in. We were putting those characters into the web address unencoded, which gave you a password prompt instead of a sign-in.
- Signing in to a site whose administrator folder sits behind htaccess directory protection no longer breaks page builders and other admin tools. We now move your browser on to a clean address the moment it has authenticated, so extensions such as YOOtheme Pro's page builder work again instead of failing with "Request cannot be constructed from a URL that includes credentials". Thanks Sven-Holger!
- The audit email configuration check now picks the right site when one hostname hosts more than one install, and matches sites whose stored URL differs by www or capitalisation.
Security
- Sites running Regular Labs Sourcerer (sourcerer) below 16.0.0 are now flagged. The Joomla CNA widened CVE-2026-74253, an unauthenticated remote code execution scored CVSS 10.0 and exploited in the wild, from below 14.0.0 to below 16.0.0, so 14.0.0, 14.0.1 and 15.0.0 are affected too despite each having been published as the fix. Our rules followed the original range, so one of your Sourcerer sites may have read clean between 17 and 26 August while it was still vulnerable. Update to 16.0.0, not 14.x or 15.0.0. Read More...
Info
- Akeeba Backup 10.4.0, released today, deprecates the Akeeba Backup JSON API v2 and Secret Word authentication for the v3 API, in favour of Joomla API tokens. Your backups keep working: Akeeba do not remove the old methods until Akeeba Backup 11.0 in October 2027. Our code for token authentication is nearly done. Urgent client work held it up, and I will get to it as soon as I can. Akeeba's announcement
New
- Joomla sites now show whether Sample Data is still switched on. Unpublishing the dashboard tile leaves the install endpoint live, so we report the module and its install plugins separately and disable both in one click. Check it out
- Where mySites.guru can already fix a Joomla core vulnerability for you, the card says so. Joomla 3 sites see which of theirs the one-click patch tool has already handled and which are still outstanding, with a link straight to the toggle. Read More...
- Joomla and WordPress sites now show which core security vulnerabilities affect the version they are running, on the Important tab. Each one names the CVE, what the flaw actually is, how serious it is, and the version that fixes it, worst first.
- Updates can now be queued to run one at a time per server, so applying updates across a lot of sites on the same host no longer throws every update at that server at once. It is off by default, and switching it on applies to the whole account. Anything still queued can be cancelled before it runs, a progress bar in the header tracks the batch, and hovering it shows a breakdown per server. Thanks Adi! Check it out
Improved
- Vulnerability pages now mark anything published in the last week with a New pill, and you can copy a record's CVE ids in one click. Check it out
- Your site list now shows a core CVE count for any site running an affected CMS version, kept separate from the vulnerable plugins count.
- The Joomla 3 end-of-life card now names how many published core vulnerabilities affect the site instead of arguing in the abstract, and how many of them we can fix for you right now.
- The Update Log has been rebuilt. It shows the last 500 updates applied across your sites, newest first, whether you applied them yourself or we applied them overnight, with the extension and version, when it ran, and whether it finished or errored. Filter on any part of a site url, extension name or status, and export the list to CSV. Check it out
Fixed
- For a fairly short period this evening, the following file was flagged as hacked when it is not. The file was empty with 3 blank lines. - the cause of this was my fat fingers hitting the wrong buttons in the right order on the wrong pages. Just run an audit to clear this false hacked alert. Sorry about that.
- WordPress core vulnerabilities now match your sites. Only the first affected version range was being stored for each advisory, so recent core advisories recorded a range that no current site could match and nothing was ever flagged.
Security
- Sites running miniOrange OAuth Client for Joomla (com_miniorange_oauth) 3.1.9 and below are now flagged. CVE-2026-77995 is an unauthenticated account takeover scored CVSS 10.0: changing one cookie value logs a visitor in as any account, administrators included. Fixed in 3.2.0. The same edition-numbering warning applies here, so confirm the build you are on rather than trusting a larger version number. Read More...
- Sites running miniOrange SAML SSO for Joomla (com_miniorange_saml) below 11.0.2 are now flagged. CVE-2026-77998 is an unauthenticated authentication bypass scored CVSS 10.0: the extension reads a failed OpenSSL signature check as a successful one, so a deliberately malformed SAML response logs an anonymous visitor in as any user, administrators included. Read your version number carefully, because miniOrange ship several separately numbered editions of the same extension. A site reporting 32.7, 42.5 or 44.0 is not necessarily newer or safer than 11.0.2, and this check cannot tell the difference. Ask miniOrange in writing which build of your edition fixes CVE-2026-77998, and treat the site as affected until they answer. The same flaw in the same vendor's WordPress plugin is already being exploited in the wild. Read More...
Info
- The API and MCP site endpoints now return core_vulnerability_count and core_vulnerabilities alongside the existing site data, under the same mcp:sites:read scope.
New
- Joomla's Shared Sessions setting is now checked on every snapshot: when it is on, one session cookie carries your administrator login into the front end, so a stolen front-end session is an admin session. The new audit row flags it, and a one-click toggle turns it off safely. Check it out
- Joomla sites now get a full Super Admin viewer. The "Limit The Number Of Super Admins To One" check lists every account holding full Super User rights and shows why each one matched, including custom groups that inherit admin from Super Users. Demote, block or delete an account, or reduce to one in a single action. Anything that would leave you unable to log in is refused.
- Every backup row now shows its .jpa archive filename with a one-click copy button, so you can find the exact file on your server.
- You can now type your own comment when you start a backup by hand, and it appears in Akeeba's Manage Backups list beside the automatic description. Scheduled and bulk backups keep the automatic label. Thanks Frédéric! Check it out
- Joomla 3 sites with unpatched end of life security issues now show a patch count on your site list. Click the badge to go straight to the fix. Check it out
- The mySites.guru MCP server has a new get_site_vulnerabilities tool, so you can ask your AI assistant which vulnerable extensions a site is running and get back the CVE, severity and the version that fixes each one.
- We now email you a daily digest when a newly vulnerable extension turns up on one of your sites. It only lists what is new since the last one, so a site that fixes one vulnerability and gains another still gets flagged. Whatever is already on your sites counts as the starting point, so you will not be emailed about that. Turn it off in Notification Preferences, or for one site under Settings on its Manage page. Thanks Christian!
Improved
- The Joomla upgrade page no longer repeats a "flagged as hacked" warning card - the page already shows its own upgrade-specific risks (Akeeba Backup, last audit age, modified core files), so the alert was redundant there.
- Vulnerability detail pages now use the full width of the screen, with the advisory facts in a summary panel beside the description. Check it out
- Start Backup on the Backups page now opens the profile picker, the same as on a site's own Backup tab, so you can choose which Akeeba profile runs.
- Backup descriptions now include the exact start time in UTC. Akeeba names each .jpa archive with a timestamp, so you can match a backup in the list to the file on your server. Thanks Frédéric!
- The vulnerable extensions panel on a site's Manage page now shows a severity badge for each finding, says which version fixes it, and links straight to the full advisory.
Fixed
- Vulnerability pages now link each CVE id to its own NVD record when a vulnerability carries several CVEs. Previously the whole list rendered as one broken link. Check it out
- Super admin detection no longer depends on the group being named "Super Users". Where that group had been renamed, or is in a language other than English or French, some user tools were silently failing to recognise super admins at all. Force MFA now covers every group that grants admin rights.
- The Details and Read More buttons on vulnerable plugin alerts are now the same height and aligned.
Updated
- The malicious cron job check is no longer marked beta. It still only works where your server's permissions allow it, and the check says so.
Security
- Sites running YOOtheme Pro (yootheme) 5.0.41 are now flagged. Two issues fixed in 5.0.42: an unauthenticated module controller endpoint that handed back any module's title and full configuration with no permission check at all, and a custom field that wrote its stored value into a form unescaped, an XSS route. Neither carries a CVE yet. Update to 5.0.42 or later. Read More...
- The Joomla 3 EOL security patch tool now covers four more core vulnerabilities disclosed since Joomla 3 went end of life: incorrect access control in the com_contact vCard download (CVE-2026-48948), XSS through language overrides (CVE-2026-48954), response header injection in download views (CVE-2026-71572), and unrestricted uploads of SHTML files (CVE-2026-73373). Six more core files are patched. One of them Joomla 3.10.12 never shipped, so switching the tool back off deletes it instead of restoring it, and only while it is still byte-identical to the copy we wrote. Read More...
New
- The contact page now leads with any current platform issues, and shows the three newest changelog entries, so you can see whether we already know about it, or already fixed it, before you write in. Check it out
Improved
- The backups list now shows each archive's description and comment under the date. Akeeba was already sending us both and we were throwing them away, so a comment you typed in Akeeba itself now appears in your dashboard too.
- Backups started from mySites.guru now carry a description that says what the site was running and what started the run, such as "Joomla 5.4.8 - Manual - mySites.guru". Every backup used to get the same fixed label, so archives taken either side of a core update were impossible to tell apart. Manual, scheduled, bulk, API and MCP runs are each named.
- After an automatic extension update we now take a snapshot of the site, so the extension versions you see are the ones you just updated to rather than yesterday's. It runs five minutes after the batch finishes, once per site.
- The JoomShaper Joomla 3 patch tool now spots a Helix Ultimate template style that has been wiped, which is what makes a site lose its header, logo and mega menu while the rest of the page still renders. Patching rebuilds the style from the template's own defaults, and affected sites are flagged "Menu" on your snapshot. Check it out
Fixed
- Sites protected by AdminExile no longer report a connector error. AdminExile blocks any administrator-side request that has no secret key in the URL, and our connector is exactly that, so it was killed mid-reply and we showed you an error instead of your site's data. The connector now identifies itself to AdminExile before the plugin runs.
- Full audits on Joomla 6 sites no longer stall at the scanner config step. We imported all 9,916 Joomla core file hashes in a single 1MB query, and on a host with a small MySQL packet limit that dropped the database connection part way through, so the scan retried until it gave up. Joomla 6 now imports them in small batches. This is the Joomla 6 connector only for now.
- Connector upgrades no longer get stuck when a single CDN edge refuses the download. The connector now falls back to our origin server, so a site sitting on NEEDSCONNECTORUPGRADE recovers on its own instead of waiting for us to spot it.
- Sites with a Let's Encrypt or Google certificate no longer show an expiry countdown. Those certificates are short-lived and renew themselves, so counting them down tells you nothing. We were matching the certificate's intermediate name against a hand-kept list, and when Let's Encrypt rotated to YE1, YE2, YR1 and YR2 that list went stale, so 41,686 sites, 61% of every site where we know the issuer, started counting down a certificate that was never going to expire on them. We now match on the issuing organisation, which stays put when the intermediates rotate. Check it out
Security
- The Rogue Super Admin check now catches a campaign that plants one Super User per site, named sysupdate followed by a few random characters, with that same name again as the email address on a domain that cannot receive mail. It is flagged wherever it sits, not only in Super Users, and can be removed in one click. Check it out
Fixed
- The SSL certificate expiry badge is back on your sites list. A change on 11 August to speed the page up stopped it loading certificate dates, so the countdown stopped appearing. Your certificates were never affected and the SSL Expiration Date tool stayed accurate throughout. Thanks Pat! Check it out
Security
- Fabrik 4.7.2 for Joomla fixes a long list of unauthenticated security issues, most of them found and reported by mySites.guru, four of them rated CVSS 10.0. If you run Fabrik, update every site to the latest 4.7.2 build. Read more...
- The Rogue Super Admin Accounts tool now flags accounts created with the joomla@test.com address, a signature seen on compromised Joomla sites. Thanks Pat! Check it out
- JoomGallery 4.4.0 fixes two security issues that have been present since 4.0.0. Protected and password-protected galleries leak image and category details, and a user who can already edit gallery content can take ownership of other people's images and inject JavaScript into some front-end views. Versions 4.0.0 to 4.3.x are affected. Both issues need a logged-in account with gallery editing permissions, so member-editable galleries are the ones to check first. If you have template overrides for JoomGallery, update those too, or the fix will not reach your site. Read More...
Fixed
- The Start Backup button did nothing on sites whose backup schedule is written as @daily, @weekly or @monthly. The shorthand broke the code that turns a schedule into plain English, and that stopped the rest of the page from setting up, so neither the backup button nor the schedule editor had anything to open. Your scheduled backups themselves were never affected and ran on time throughout. Thanks Wilm!
- For a few hours this morning we wrongly flagged YOOtheme Pro as vulnerable, including on sites already running the patched 5.0.41 and on sites with no YOOtheme Pro installed at all. The rule was matching YOOtheme's separate installer plugin, which has its own version number and could never satisfy it. It is now scoped to the template and the system plugin only, and the counts on affected dashboards have been corrected. Sorry for the scare.
- WordPress vulnerability checks now match on the wordpress.org slug alone. They previously required the advisory's title and the plugin's own name to match exactly, and those disagree for most popular plugins, so 58% of the advisories for plugins you actually run could never fire. Elementor Pro, Yoast SEO, Wordfence Security and WP Mail SMTP advisories had never flagged a single site.
- Akeeba Backup no longer fails with an "Invalid method" error on hosts that redirect uppercase query parameters. The redirect stripped the body from our request, so Akeeba never saw which method we asked for.
- WooCommerce Product Filters is no longer flagged by an advisory meant for a different vendor. Barn2 and WooCommerce both ship a plugin in a folder called woocommerce-product-filters, so Barn2's advisory was firing on unaffected WooCommerce installs. The vendor name now has to agree too.
- Vulnerability checks now read 4.3 and 4.3.0 as the same release. A plugin you have already updated is no longer flagged just because its advisory writes the fixed version with more parts than the plugin reports. Thanks Andrzej!
- WP File Manager 8.0.4 is no longer flagged as vulnerable. The upstream advisory listed its fixed version as 8.4.3, which only exists in the paid Pro plugin, so sites already on the newest free release were being flagged with nothing to update to. Thanks Andrzej! Check it out
- A backup warning containing HTML, such as the error page Google returns when a Drive upload fails, could break the layout of the backups page. Warning text is now shown as plain text. Thanks Peter! Check it out
New
- Joomla 5.4.8 and 6.1.3 break the Template Manager, so creating overrides and folders fails. A new tool shows which of your sites are affected and applies or removes the fix from Joomla PR #48274, checking the file before and after every write. Check it out
New
- WordPress 7.1 Released!
Security
- Elementor Pro 4.2.2 fixes an unauthenticated file upload that hands an attacker code execution on your server (CVE-2026-32475, CVSS 9.0). Everything up to and including 4.2.1 is affected. Elementor Pro only updates itself while its licence key is valid, so a lapsed licence means 4.2.2 is never offered and nothing on the dashboard says so. Check wp-content/uploads/elementor/forms/ for stray .php files. Read More...
- Sites running YOOtheme's ZOO (com_zoo) below 4.1.64 are now flagged. Three security issues, all found and reported by us, and none of them needs a login: an image upload on front-end submission forms that lets anyone run PHP on your server, a SQL injection that reads your database and needs no submission form at all, and an open redirect. Update every ZOO site to 4.1.64, then check images/zoo/uploads/ for anything that is not an image. Read More...
New
- Joomla 5.4.8 Released!
- Joomla 6.1.3 Released!
- You can now turn off the audit's email test on a site-by-site basis. On a site's Config page, under Advanced, switch on 'Skip the email test' and we stop asking that site to send the test email, and hide the Email Configuration row from its audit results. Off by default. Read More...
Fixed
- For a short period of time this evening, AI incorrectly flagged the following file as hacked when it wasn’t. HTMLPurifier/VarParser/Native.php We have reverted this, and now if you run a new audit, your site should not be flagged as hacked.
Security
- Our Balbooa Forms write-up has been updated for the 2.4.3.2 and Balbooa Gallery 2.5.1.1 releases. It now covers the full run of four security releases in six weeks, what a hardening notice with no CVE and no affected version range leaves you unable to work out about your own sites, the wording this release shares with Gridbox 2.20.2.3, and how to check a Balbooa Gallery install that still reports the old com_bagallery element. Read More...
- Sites running Balbooa Forms below 2.4.3.2 or Balbooa Gallery below 2.5.1.1 are now flagged. Balbooa shipped both as security hardening with no CVE, no severity and no affected version range published, so the rules flag everything below the fixed builds, as the vendor advises. Two of the five areas fixed in Forms, payment amount verification and post-submission PHP script handling, run when an anonymous visitor submits a form. Two things to watch. Sites still on Balbooa Forms 2.4.2.1 or below are flagged separately and more severely, because they remain exposed to CVE-2026-65880, an unauthenticated remote code execution scored 10.0. And Balbooa Gallery was renamed from com_bagallery to com_gallery before the 2.5 line, so if your install still reports com_bagallery, check you are genuinely being offered 2.5.1.1 rather than assuming it. Check your extensions
Improved
- Uptime alert emails now link to the full explanation of how our monitoring works, including why a site that never went down can still be reported as down, and to the list of IP addresses your host must not block. Read More...
- Deep file scans now skip backup archives instead of trying to pattern-match the binary data inside them. A single 1MB Akeeba .jpa was burning 80 seconds of a scan window on its own. Akeeba .jpa and .jps, split archive parts, and .tar, .tgz, .bz2, .xz, .rar and .7z are all skipped now.
Fixed
- Deep file scans could stop early on shared hosting with a "MySQL server has gone away" error. Scanning a large file with a single pattern match can run for a minute with no database activity at all, which is long enough for a host to drop the connection as idle. The scanner now reconnects before it next needs the database, and asks for a longer idle timeout where the host allows it.
- Sites are no longer reported as vulnerable when the extension does not report a version we can actually read. Manifests in the wild carry an empty version, "n/a", or an unreplaced placeholder, and those were ranking below every version ceiling, so a rule saying "below 4.1.5" matched them on no evidence at all. That was 442 site rows when we measured it. We would rather under-report on a genuinely old install than accuse a current one.
- Extensions that report a Pro or Free edition inside their version number (13.1.1PRO, 3.3.0-FREE, 6.0.3 PRO) are now matched properly against our vulnerability rules. The suffix was sorting below the plain number, which broke both ends of a range at once: sites that had already installed the fix were flagged, and sites still running the vulnerable build were missed. Measured against live data, 8 sites were wrongly flagged and 80 vulnerable ones were being missed. Regular Labs extensions such as Sourcerer were the most affected.
Updated
- Our Page Builder CK disclosure post now covers the two later security releases, 3.6.4 and 3.6.5, and the new CVE-2026-74254 for the SQL injection in the styles handling. Read More...
Security
- Sites running a vulnerable iCagenda Calendar module are now flagged. CVE-2026-67365 is an unauthenticated SQL injection reachable through com_ajax with no session, token or account, scored CVSS 4.0 9.2 Critical by the Joomla CNA, and fixed in 4.0.12. Check the module version rather than the package version: the module stayed at 4.0.7 across the 4.0.8, 4.0.9, 4.0.10 and 4.0.11 releases, so a site can show iCagenda 4.0.11 while the vulnerable module is still installed. Read More...
- Sites running Sourcerer 13.x are now flagged. Regular Labs 14.0.0 stops PHP executing from page content Sourcerer cannot trace to a verified source, and every 13.x build is affected, including 13.1.1 from 5 August. No CVE covers the 13.x line, so the CVSS 4.0 figures in our write-up, 7.7 High rising to 9.2 Critical where another extension renders raw input, are our own provisional assessment. Note that Pro builds report a PRO suffix, so 13.1.1PRO is affected too. Read More...
- Sites running Page Builder CK 3.6.4 are now flagged. CVE-2026-74254 is an authenticated SQL injection in the extension's styles handling, and 3.6.4 is the release that was meant to fix it: the correction reached only one of the two affected code paths, so anyone who can edit page content could still reach the database. Update to 3.6.5. Page Builder CK has carried a security fix in all six releases since June and two of those fixes were incomplete, so 3.6.5 is the version to be on, not 3.6.0 or 3.6.3. Check it out
Security
- Fabrik: we obtained the 4.7.0 release candidate and audited its source, which has never been public. Both CVSS 10.0 unauthenticated remote code execution flaws are properly fixed. Joomla's updater will not offer 4.7.0 at default settings, and on Joomla below 5.4 it will not offer it at all, so plan on a manual install. Read More...
- Sites running a vulnerable Phoca Cart are now flagged. CVE-2026-74251 is an unauthenticated SQL injection in the product filter, scored CVSS 9.3 Critical, and every branch below 5.2.4 and 6.1.7 is affected, including Joomla 3 and Joomla 4, which have no fixed release at all. The one to watch is a Joomla 5 site running Phoca Cart 6.x: Joomla's updater offers it 5.2.4, discards that as older than what is already installed, and reports nothing to update, so the site keeps reporting itself up to date. Check it out
Improved
- Every page now does less work behind the scenes: your last seen time is no longer written to the database on every single request, your subscription status is cached for five minutes rather than re-checked constantly, and sites whose favicon could not be captured have stopped re-queueing themselves on every page view.
- The Extensions tab on a site no longer builds every extension type's table up front. One site with 582 extensions was sending 4.9MB of hidden HTML on every load, now 2.7MB, and the other type tabs fetch their table the first time you open them.
- Your sites list loads faster. It was decrypting fifteen stored credentials per site and pulling down connector error logs and screenshot data the page never draws, one of them 5MB on a single row. It now reads only the columns it actually shows. Check it out
Fixed
- Hosts running Imunify360 were deleting bfAuditor.php from your site, believing our own file scanner was a hacking tool. The heuristic keys on three of the scanner's functions appearing in one file, so the false positive exceptions now live in a separate file. If a host deletes that one instead, the audit names it, so you know what to ask them to restore.
- Buttons on the Investigate tool pages sometimes did nothing. Two scripts were each reloading the tool panel and racing each other, and when the wrong one won it replaced a working panel with an identical looking copy whose buttons had never been wired up. It came and went with your connection speed. There is one load now.
Security
- Fabrik (com_fabrik) vulnerability flag updated: anything below 4.7.0 is now flagged. The revised CVE-2026-66915 record covers 4.6.8, so sites updated to 4.6.7 or 4.6.8 are still affected. Read More...
New
- WordPress 7.0.4 Released!
New
- Joomla 5.4.7 and 6.1.2 quietly ignore every per-article Option on the front end. Your snapshot now counts the articles affected on each site, and Tools will apply Joomla's official hotfix on request - only to an unmodified core file, and only if the result matches Joomla's own patched file byte for byte.
Fixed
- Site listing pages now fill the full screen width on Android tablets. Samsung Internet was zooming the whole page out to fit, which left a blank strip down the right-hand side. Check it out
- Extension updates no longer fail on sites protected by the AdminExile plugin.
Security
- Fabrik (com_fabrik) vulnerability flag updated: Fabrik released 4.6.8 the day after 4.6.7, with a second security fix in its list filters and no CVE. Sites are now flagged below 4.6.8 rather than below 4.6.7, so anything updated to 4.6.7 will flag again on its next audit. Read More...
Blogged
- Twenty Rules for Joomla Extension Developers Handling a Security Report
- Joomla 6.1.2 and 5.4.7 Silently Ignore Every Article Option
- JCE 2.9.99.10 Fixes Another Security Issue
- Pre-Authentication SQL Injection and Mail Relay in SP Page Builder found by mySites.guru
- Exposed Customer Invoices, Order Forgery and SQL Injection in EasyStore for Joomla found by mySites.guru
- Fabrik for Joomla Ships Two Security Releases in Two Days: Update to 4.6.8
Improved
- Backup, Snapshot and Export now show how many sites they will affect once you filter your list, so the button reads Snapshot (12) rather than just Snapshot. Thanks Adi!
Fixed
- Snapshot and Export on your sites list now act only on the sites matching your current filter, rather than every site in your account. Backup already worked this way. Thanks Adi! Check it out
New
- WordPress 7.0.3 Released!
Security
- We're seeing hacks hidden inside SVG files, so our file scanner now audits them instead of skipping them.
New
- Our contact page now answers 38 of the questions we get asked most: sites that will not reconnect, which IPs to whitelist, what to do when a host quarantines the connector, why a file is flagged, and how to change or cancel a plan. Check it out
Fixed
- Joomla vulnerability rules can now be pinned to a plugin's folder as well as its element name. The GeoIP rule matched on the name alone, so alongside Regular Labs' GeoIP it flagged three unrelated extensions that happen to share it, from Membership Pro, SEBLOD and Michael Richey. 94 sites were flagged wrongly against 56 genuine ones.
- The WordPress and Joomla 6 connectors now fall back to curl when your host blocks allow_url_fopen or strips out the https stream wrapper. On those servers the fetch returned nothing and raised no error, so anything that needed to reach us stopped working with no sign of why.
- Alert emails no longer build links with a double slash in them, like https://yoursite.com//administrator/index.php. The Joomla user alerts and five WordPress ones all carried it.
- The Learn More page for Unpatched JoomShaper Security Holes now flags an extension carrying an older release of the patch as "patched - update available". It was reading as fully patched while the snapshot page showed an update waiting.
New
- You can now report a security problem in the platform or the connector through our published security policy: where to send it, what is in scope, how quickly we respond, and the safe harbour you get for good-faith research. There is a machine-readable copy at /.well-known/security.txt, and a CycloneDX software bill of materials we regenerate on every dependency change.
Improved
- The Hacked? panel now says plainly that Full Audit suspect patterns do not on their own mean your site is hacked, and uses a warning colour rather than another block of red. Still worth a look: real hacked files do turn up in there.
- The contact page now puts the three ways to get help side by side: free support for anything about the service, free debugging when a site will not connect, and a fixed fee job if you would rather Phil fixed it on your site himself. Check it out
Fixed
- Firefox no longer draws a stray scrollbar down site lists and the extensions pages.
- Site thumbnails that failed to capture no longer spin forever. 5,177 sites were stuck on a loading spinner; they now show a placeholder and a refresh button. New thumbnails are captured when you first open a page that shows them, rather than for sites nobody ever looks at. Check it out
- Sites running Akeeba SocialLogin or Admin Tools could come back empty instead of reporting their data. The connector now hands Joomla a guest identity before third party system plugins load, which is what those plugins expect to find.
- Malware scans no longer fail on servers that cannot reach our CDN. The connector falls back to fetching the detection patterns straight from manage.mysites.guru.
- Cron Jobs [BETA] no longer reports your host's own cron-auditing script as malicious. Those scripts search crontabs for the same words we look for, and the word list inside them was being read as a payload. A search pattern is now treated as data, while anything chained after it is still checked.
- Our malware detector no longer trips your host's own antivirus. A scanner has to contain the patterns it hunts for, and ImunifyAV, Imunify360 and WordFence were matching ours inside the connector and quarantining the files, which broke the connection to your site. Every signature is now stored encoded and rebuilt only while a scan runs.
- Logging in to a Joomla site from mySites.guru no longer rewrites configuration.php. Joomla puts its runtime values back into the config on every boot, so our cleanup found work to do every single time and saved the file. That is why RSFirewall and Admin Tools emailed you a "configuration.php has changed" alert after every login. When a save is genuinely needed, the file now matches what Joomla core itself writes.
Security
- Malware scanning no longer skips .flv files, so a payload hidden in one on your server is found instead of ignored.
Try it on your own sites
Connect one of your own sites and see what the dashboard finds on it.