JoomShield: Complete Security Extension for Joomla

JoomShield lets you add a secret access key to your admin login URL. Once enabled, the default administrator login page won't load for anyone without that key, which keeps bots and scanners from ever finding a login form to attack. You also get to decide what happens when someone tries the old login path without the key, such as redirecting them to your homepage instead of showing an error that confirms Joomla is running underneath.

Yes. JoomShield tracks failed login attempts by IP address and blocks the source once a set threshold is crossed, so repeated password-guessing attempts get shut down automatically. You can also choose to notify affected users by email when their account is targeted, so they know to check their password and account activity even if the attack didn't succeed.

Yes. You can block sign-ups from disposable email domains at the registration step, which keeps spam accounts and fake registrations from ever reaching your user list. This cuts down on the junk accounts that inflate your member count without ever engaging, and it reduces the spam activity that often follows once a fake account gets through.

Yes. You can whitelist or block individual IP addresses or entire ranges, and import a list of addresses in bulk instead of adding them one at a time. By default every IP address can reach your site, so this feature gives you the option to lock things down to a known set of addresses, such as your office network or a client's location, or to keep out addresses you've flagged as a source of abuse.

Yes. JoomShield supports Joomla 3, 4, 5, and 6, so it works regardless of which version your site is currently running. This means you can install JoomShield on an older site without planning a migration first, and it will keep working as you eventually upgrade to newer Joomla releases.

No. JoomShield's checks run in the background during login, registration, and request filtering, so normal visitors and logged-in users don't notice any added load time. The extension only does extra work at the specific points where security decisions need to be made, such as a login attempt or a new registration, rather than on every page load.