![TemplinTech™ Admin Guard for the Joomla! CMS [Documentation]](/images/documention-templintech-admin-guard.jpg "TemplinTech™ Admin Guard for the Joomla! CMS [Documentation]")
TemplinTech Admin Guard is a security-focused system plugin for Joomla that adds an additional access layer in front of the standard Joomla Administrator interface. Its purpose is to restrict direct access to /administrator/ before the standard Joomla Administrator login page is displayed.
The plugin is designed for Joomla 6 using modern Joomla architecture without legacy Joomla APIs. It is suitable for standard shared hosting as well as VPS, dedicated server, and SSH/CLI environments.
Version: 1.0.5 Stable
License: GPLv2 or later
Developer: Dr. Yordan Balabanov, representing TemplinTech
1. Important Warning Before Activation
WARNING
TemplinTech Admin Guard is a security extension that can intentionally block standard access to the Joomla Administrator area.
You activate and use this plugin entirely at your own risk.
Before enabling protection, you should be familiar with the basic administration of Joomla and know how to access your website files through File Manager, FTP/SFTP, SSH, or another method provided by your hosting provider.
This plugin should be considered an advanced security tool. Incorrect HTTPS configuration, IP restrictions, reverse proxy settings, or loss of the Gate URL / Access Key may temporarily prevent you from accessing Joomla Administrator.
Do not enable Protection until you have verified the recovery mechanism described in this documentation.
The developer cannot guarantee that a website cannot be compromised. TemplinTech Admin Guard is an additional security layer and does not replace Joomla updates, secure hosting, strong passwords, MFA/passkeys, proper server configuration, a firewall, or a WAF.
2. What TemplinTech Admin Guard Does
In a standard Joomla installation, the Administrator interface is normally available at:
https://example.com/administrator/
This means that any visitor, bot, or automated scanner may reach the standard Joomla Administrator login page.
When TemplinTech Admin Guard is active, a direct request to:
/administrator/
can, for example, return:
404 Not Found
Instead of receiving the standard Joomla login page, the user must first use the generated Gate URL, for example:
https://example.com/administrator/?templintech-admin-guard=g-...
An additional Access Key is then required. Only after this protection layer has been successfully passed is access to the standard Joomla authentication system allowed.
The access flow is:
Internet
↓
/administrator/
↓
TemplinTech Admin Guard
↓
Gate URL
↓
Access Key
↓
Joomla Administrator Login
↓
Joomla username + password
↓
MFA / Passkey, if enabled
↓
AdministratorTemplinTech Admin Guard does not replace Joomla authentication. It adds a separate pre-authentication layer in front of it.
3. System Requirements
For TemplinTech Admin Guard 1.0.5, the following environment is recommended:
- Joomla 6.1.3 or a newer supported version;
- PHP 8.3 or a newer supported version;
- HTTPS with a valid TLS certificate;
- access to the Joomla Plugin Manager;
- access to File Manager, FTP/SFTP, or SSH for emergency recovery;
- an up-to-date Joomla installation without known unpatched security vulnerabilities.
For production websites, Joomla Administrator should be accessible only over HTTPS.
4. Installation
4.1. Installing the Package File
In Joomla Administrator, open:
System → Install → Extensions
Upload the TemplinTech Admin Guard package file.
The package contains two Joomla plugins:
- System - TemplinTech Admin Guard – the main protection layer;
- Console - TemplinTech Admin Guard – CLI recovery and administrative commands for environments with SSH/CLI access.
Installing the package by itself should not automatically activate protection for /administrator/.
4.2. Verification After Installation
Open:
System → Manage → Extensions
and verify that TemplinTech Admin Guard and both child plugins are listed.
Then open:
System → Plugins
and locate:
System - TemplinTech Admin Guard
The main System plugin can be enabled while the Protection parameter remains set to No.
This allows configuration and testing before the Administrator area is actually restricted.
5. Choose the Correct Activation Method for Your Hosting Environment
Recovery preparation differs depending on the hosting environment. Do not skip this section.
5.1. Shared Hosting – Recommended Procedure
This method is appropriate for standard hosting plans without SSH, including environments using:
- hosting File Manager;
- Plesk;
- cPanel;
- DirectAdmin;
- FTP;
- SFTP.
Before enabling Protection, first locate the Joomla root directory.
This is the directory that normally contains:
administrator/
components/
modules/
plugins/
templates/
configuration.php
index.phpThen locate:
/plugins/system/templintechadminguard/
Make sure you can create a file in this directory if necessary.
The emergency recovery file is:
templintech-admin-guard.disable
The full path is:
/plugins/system/templintechadminguard/templintech-admin-guard.disable
Important: the file does not need to exist permanently. You only need to confirm in advance that you can create it through File Manager or FTP if you lose access to Joomla Administrator.
5.2. VPS / Dedicated Server / SSH Hosting
On a server with SSH access, you can use both the filesystem recovery mechanism and Joomla Console.
From the Joomla root directory, commands may include:
php cli/joomla.php templintech-admin-guard:status
php cli/joomla.php templintech-admin-guard:disable
php cli/joomla.php templintech-admin-guard:enable
php cli/joomla.php templintech-admin-guard:rotate
For these commands, the following plugin must be enabled:
Console - TemplinTech Admin Guard
5.3. Reverse Proxy / CDN / Cloudflare
If your website is behind a reverse proxy, load balancer, Cloudflare, or similar infrastructure, do not enable IP restrictions immediately.
First determine which IP address reaches PHP as:
REMOTE_ADDR
Forwarded headers should not automatically be trusted because they may be spoofed unless they originate from a trusted proxy.
Use trusted proxy settings only when you know the exact proxy CIDR ranges and understand how the forwarding chain works.
6. HTTPS Configuration
Before enabling Admin Guard, verify the Joomla HTTPS configuration.
Open:
System → Global Configuration → Server
Locate:
Force HTTPS
For Administrator protection, at minimum use:
Administrator Only
If the entire website operates permanently over HTTPS, you may use:
Entire Site
The Access Key and authenticated Joomla sessions should never be transmitted over an unsecured HTTP connection.
7. Generating the Gate ID and Access Key
Open:
System → Plugins → System - TemplinTech Admin Guard
While:
Protection = No
generate the Gate ID and Access Key using the corresponding button.
You will receive a Gate URL similar to:
https://example.com/administrator/?templintech-admin-guard=g-...
and an Access Key in a format similar to:
TTAG-...
7.1. What Is the Gate URL?
The Gate URL is the dedicated entry point to Admin Guard.
The query parameter:
templintech-admin-guard
is specifically namespaced for the extension to reduce the risk of conflicts with Joomla core, other extensions, or custom application code.
The Gate ID should be treated as a locator, not as the sole password.
Even if the Gate URL becomes known, the Access Key remains a separate secret required to pass the Guard layer.
7.2. Access Key
The Access Key is generated using a cryptographically secure random generator.
Save it immediately in a trusted password manager.
The plaintext Access Key is not stored for later display.
If you lose it, it should not be retrieved in plaintext. Instead, generate a new one through credential rotation.
8. Test Before Enabling Protection
Do not enable Protection immediately after generating credentials.
First open a new Incognito / Private browser window.
Enter the Gate URL.
You should see the TemplinTech Admin Guard Access Key page.
Enter the correct Access Key.
After successful unlocking, you should reach the standard Joomla Administrator login page.
This confirms the following flow:
Gate URL
↓
Access Key
↓
Guard authorization
↓
Joomla Administrator loginWhile Protection = No, direct access to /administrator/ may remain available. This is normal during setup.
9. Recommended Initial Configuration
For an initial production setup, especially on shared hosting, the following settings are recommended:
| Setting | Recommended Value |
|---|---|
| Protection | No until all tests are complete |
| Unauthorized request | 404 Not Found |
| Require HTTPS | Yes |
| Local rate limiting | Yes |
| Restrict by client IP | No during initial setup |
| Trust reverse proxy headers | No, unless the infrastructure is clearly understood |
10. Unauthorized Request Behavior
10.1. 404 Not Found – Recommended Stealth Mode
In this mode, direct access to:
/administrator/
returns a real HTTP:
404 Not Found
The response is intentionally minimal and does not display the Joomla Administrator interface, TemplinTech branding, or information about Admin Guard.
This is the recommended mode for most websites.
10.2. 403 Forbidden
In this mode, the request returns:
403 Forbidden
This explicitly indicates that the resource exists but access is not permitted.
For stealth-oriented configurations, 404 is therefore generally preferable.
10.3. Redirect to Homepage
If redirect mode is selected, an unauthorized request may be redirected to the website homepage.
This option may be more user-friendly in some environments, but it is less stealth-oriented because automated scanners can more easily identify redirect behavior.
11. Enabling Protection
After you have:
- verified recovery access;
- properly configured HTTPS;
- saved the Gate URL;
- saved the Access Key;
- successfully tested the Gate URL in an Incognito window;
you may change:
Protection = No
to:
Protection = Yes
and save the configuration.
During activation, the plugin performs additional checks intended to reduce the risk of self-lockout.
Do not close your currently working Joomla Administrator session until you have verified the protection from a second Incognito browser window.
12. Mandatory Test After Activation
12.1. Test the Direct Administrator URL
From a new Incognito window, open:
https://example.com/administrator/
When using 404 mode, you should receive:
404 Not Found
The standard Joomla login page should not be displayed.
12.2. Test the Gate URL
Then open:
https://example.com/administrator/?templintech-admin-guard=g-...
You should receive the Admin Guard Access Key page.
12.3. Test an Incorrect Access Key
You may test once that an incorrect Access Key is rejected.
Do not intentionally perform multiple consecutive failed attempts, because local rate limiting may temporarily block further requests.
12.4. Test the Correct Access Key
After entering the correct Access Key, you should reach the Joomla login page.
Then sign in using your normal Joomla Administrator account.
If you use MFA or a passkey, it continues to operate as a separate Joomla authentication layer.
13. Local Rate Limiting
TemplinTech Admin Guard includes a local mechanism for limiting repeated failed Access Key attempts.
This mechanism is intended to reduce automated abuse of the Guard endpoint.
It operates locally and does not require:
- Redis;
- Memcached;
- an external API service;
- a cloud security service;
- an additional database table.
This makes it suitable for shared hosting environments.
Local rate limiting should not be considered a replacement for server-level rate limiting, a WAF, or a firewall in high-load or high-risk environments.
14. IP Restrictions
An IP allowlist can further restrict Administrator access to specific addresses or networks.
IPv4, IPv6, and CIDR networks may be used according to the supported settings.
Example:
203.0.113.25
or CIDR:
203.0.113.0/24
IP restriction is not recommended for users with a dynamic residential IP address unless they understand the consequences.
If your public IP address changes, you may unintentionally block your own access.
For this reason, the recommended initial setting is:
Restrict by client IP = No
15. Trusted Proxy Settings
Do not automatically trust HTTP headers such as:
X-Forwarded-For
or:
X-Forwarded-Proto
These headers can be spoofed by a client if the request is not coming through a genuinely trusted proxy.
Trusted proxy mode should be used only when:
- the website actually operates behind a reverse proxy / CDN / load balancer;
- you know the IP/CIDR ranges of the trusted proxy servers;
- you understand the forwarding chain behavior.
For standard shared hosting without a clearly defined reverse proxy, leave this feature disabled.
16. Rotating the Gate ID and Access Key
If the Gate URL or Access Key may have been exposed, perform credential rotation.
Rotation generates a new set of credentials.
The previous Gate URL and Access Key are invalidated according to the current authorization generation.
After rotation:
- save the new Gate URL;
- save the new Access Key;
- update your password manager;
- test the new Gate URL in an Incognito window;
- remove the old bookmark, if applicable.
17. Emergency Recovery on Shared Hosting
This is one of the most important sections of this documentation.
If you cannot reach Joomla Administrator because of an incorrect configuration, a lost Gate URL, IP restrictions, or another issue, SSH access is not required.
17.1. Recovery Through File Manager / FTP
Open the Joomla directory:
/plugins/system/templintechadminguard/
Create a file with the exact name:
templintech-admin-guard.disable
The file may be empty.
On the next request, the Admin Guard bootstrap mechanism checks for this marker file before activating the main Guard logic.
Then try again:
https://example.com/administrator/
After correcting the configuration:
- leave Protection disabled;
- verify the Gate URL and Access Key;
- delete the recovery marker file;
- perform another test;
- only then re-enable Protection.
Do not leave templintech-admin-guard.disable permanently in the directory. While this file exists, the protection layer is bypassed.
18. Emergency Recovery Through the Hosting Database Manager
The filesystem marker is the recommended recovery method for shared hosting.
However, if the plugin bootstrap file itself is damaged and PHP cannot reach the marker check, it may be necessary to disable the System plugin directly through phpMyAdmin or another database management tool.
In the Joomla table:
#__extensions
locate the record with:
type = plugin
folder = system
element = templintechadminguardand change its:
enabled
field to:
0
Do not delete the extension record.
This procedure is intended for emergency recovery and should be performed only by users who understand Joomla database management.
19. Recovery and Management Through Joomla CLI
On a VPS, dedicated server, or hosting environment with SSH, you may use Joomla Console.
19.1. Status
php cli/joomla.php templintech-admin-guard:status
19.2. Disable
php cli/joomla.php templintech-admin-guard:disable
19.3. Enable
php cli/joomla.php templintech-admin-guard:enable
19.4. Rotate Credentials
php cli/joomla.php templintech-admin-guard:rotate
The Console plugin must be available and enabled for CLI functionality.
20. Security Model
TemplinTech Admin Guard is designed as an additional pre-authentication security layer.
Its core principles include:
- cryptographically random Gate ID;
- cryptographically random Access Key;
- the Access Key is not stored as a recoverable plaintext secret;
- constant-time verification;
- Joomla CSRF protection;
- session regeneration after successful Guard authentication;
- HTTPS enforcement;
- local rate limiting;
- security response headers;
- no remote JavaScript;
- no CDN dependency;
- no telemetry;
- no analytics;
- no external authentication service;
- no custom database table for the core Guard logic.
21. Security Response Headers
For standalone Guard and denial responses, the plugin may use protective HTTP headers such as:
Cache-Control: no-store
Pragma: no-cache
Referrer-Policy: no-referrer
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Robots-Tag: noindex, nofollow, noarchiveThe purpose is to prevent Guard pages and denial responses from being unnecessarily cached, indexed, or embedded.
22. Privacy
TemplinTech Admin Guard is designed to operate locally within the Joomla environment.
By default, the plugin does not require:
- telemetry;
- advertising trackers;
- analytics;
- an external authentication API;
- remote JavaScript libraries;
- cloud-based credential verification.
When IP-based security features are used, the administrator is responsible for evaluating the applicable privacy and data protection requirements for the specific website and jurisdiction.
23. What TemplinTech Admin Guard Cannot Protect by Itself
TemplinTech Admin Guard is not a web application firewall and does not replace server security.
It cannot independently protect a website if, for example:
- the hosting account has already been compromised;
- an attacker has FTP/SFTP/SSH/control-panel access;
- another extension contains a remote code execution vulnerability;
- Joomla core or PHP is outdated and vulnerable;
- a valid Administrator session cookie has been stolen outside the Guard security model;
- the server or reverse proxy itself has been compromised.
23.1. Important Limitation Regarding /administrator/
A Joomla plugin operates after the PHP/Joomla application has started.
Therefore, Admin Guard can protect the Joomla Administrator application and login flow, but it cannot independently block every physical static file under:
/administrator/...
if that file is served directly by Apache, Nginx, or another web server without executing Joomla.
Complete directory-level restriction requires additional server-level mechanisms such as:
- Apache configuration;
- Nginx configuration;
- reverse proxy rules;
- WAF;
- hosting firewall.
24. Use Joomla MFA / Passkeys
TemplinTech Admin Guard is not a reason to disable Joomla Multi-Factor Authentication.
The recommended production model is:
TemplinTech Admin Guard
+
Joomla username/password
+
MFA / Passkey
+
Regular Joomla updates
+
Secure hosting configurationThis creates multiple independent layers of protection.
25. Updates
TemplinTech Admin Guard uses the Joomla Update System.
Security updates should be installed promptly.
Before updating a production website, it is good practice to have:
- a current backup;
- access to hosting File Manager/FTP;
- a verified recovery procedure;
- the ability to temporarily disable the System plugin.
After a significant security update, perform a brief test again for:
- direct
/administrator/access; - the Gate URL;
- the Access Key;
- Joomla login;
- the recovery marker file.
26. Recommended Production Configuration
For a typical Joomla website on shared hosting, the recommended baseline configuration is:
Protection: Yes
Unauthorized request: 404 Not Found
Require HTTPS: Yes
Local rate limiting: Yes
IP restriction: No
Trusted proxy headers: No
Joomla Force HTTPS:
Administrator Only or Entire Site
Joomla MFA / Passkey:
EnabledIP and proxy restrictions should be added only when they are genuinely required and properly understood.
27. Final Configuration Checklist
After installation and activation, verify the following:
- File Manager/FTP recovery access works.
- The Gate URL is stored securely.
- The Access Key is stored in a password manager.
- HTTPS is enabled.
- Protection is enabled.
- Direct
/administrator/access returns the selected denial response. - The Gate URL opens the Access Key page.
- An incorrect Access Key does not provide access.
- The correct Access Key allows access to Joomla authentication.
- Joomla MFA/passkey works.
- Logout works normally.
- The recovery marker file can temporarily bypass Guard.
- After deleting the recovery marker file, Guard protection is restored.
28. Troubleshooting
I Cannot Open /administrator/
If Protection is enabled, this is probably expected behavior. Use the Gate URL.
I Lost the Gate URL
Use the recovery mechanism to restore Administrator access, then generate a new Gate ID and Access Key.
I Lost the Access Key
The Access Key should not be recoverable as plaintext. Use credential rotation.
I Enabled IP Restriction and Can No Longer Sign In
On shared hosting, create:
/plugins/system/templintechadminguard/templintech-admin-guard.disable
Correct the IP configuration and then delete the recovery file.
The Website Is Behind Cloudflare or a Reverse Proxy
Do not enable forwarded-header trust until the trusted proxy ranges have been configured correctly.
I Do Not Have SSH Access
SSH is not required. On shared hosting, the primary recovery mechanism is the File Manager / FTP marker file.
The Plugin Is Damaged and the Marker File Does Not Help
Disable the System plugin through the hosting database manager / phpMyAdmin using the Joomla #__extensions table.
29. Disabling and Uninstalling
If you no longer want to use the protection, first set:
Protection = No
Verify that standard Administrator access works.
Then you may disable:
System - TemplinTech Admin Guard
and, if necessary:
Console - TemplinTech Admin Guard
Only then uninstall the package through the Joomla Extension Manager.
Directly deleting plugin files through FTP is not recommended as a normal uninstall method.
30. Security Best Practices
For a more secure Joomla Administrator environment:
- keep Joomla up to date;
- keep PHP on a supported version;
- use HTTPS for the entire website or at least Administrator;
- use unique, strong Joomla passwords;
- enable MFA or passkeys;
- do not publish or publicly share the Gate URL;
- do not transmit the Access Key through unsecured channels;
- do not reuse the Access Key for other services;
- periodically review installed Joomla extensions;
- remove unused extensions;
- maintain regular backups;
- review server and Joomla logs for suspicious activity;
- use server-level or WAF protection in higher-risk environments.
31. Quick Summary
TemplinTech Admin Guard adds a separate security layer in front of Joomla Administrator authentication.
The correct setup sequence is:
1. Install the package.
2. Verify recovery access.
3. Enable the System plugin.
4. Keep Protection = No.
5. Generate Gate ID + Access Key.
6. Save the credentials.
7. Test the Gate URL in Incognito mode.
8. Verify HTTPS.
9. Enable Protection.
10. Test direct /administrator/ access.
11. Test the Gate URL.
12. Test emergency recovery.
13. Delete the recovery marker file.
14. Use Joomla MFA / Passkey.The most important rule: never activate a security mechanism that can block administrative access before you have verified how to recover access if something goes wrong.
32. License and Developer
TemplinTech Admin Guard
Developer:
Dr. Yordan Balabanov, representing TemplinTech
License:
GNU General Public License version 2 or later (GPLv2 or later)
TemplinTech Admin Guard uses the Joomla Update System to distribute updates.
