TemplinTech Admin Guard 1.0.5 is now available as a stable release for Joomla 6.
The extension adds a dedicated pre-authentication access-control layer in front of the Joomla Administrator application. Its purpose is to prevent the standard Administrator login flow from being directly presented to every unauthorized request reaching /administrator/.
TemplinTech Admin Guard operates before the standard Joomla authentication step and does not replace Joomla user accounts, passwords, Multi-Factor Authentication, or passkeys.
An Additional Layer Before Joomla Administrator
When protection is enabled, a direct request to:
https://example.com/administrator/
can be handled using:
- HTTP 404 Not Found;
- HTTP 403 Forbidden;
- an optional redirect to the site homepage.
The recommended 404 mode returns a minimal standalone HTTP response without rendering the Joomla Administrator template or the standard Administrator login form.
Authorized administrative access is performed through an individually generated Gate URL:
https://example.com/administrator/?templintech-admin-guard=g-...
A separate cryptographically generated Access Key must then be supplied.
Key Features
- pre-authentication access control for the Joomla Administrator application;
- HTTP 404 and HTTP 403 response modes for unauthorized access;
- optional redirect to the site homepage;
- cryptographically generated Gate ID and Access Key;
- the Access Key is not stored as a recoverable plaintext secret;
- HTTPS enforcement;
- Joomla CSRF protection;
- Joomla session identifier regeneration after successful Guard authorization;
- local rate limiting for failed Access Key attempts;
- optional IPv4, IPv6, and CIDR allowlisting;
- controlled trusted reverse-proxy support;
- credential rotation;
- security response headers;
- shared-hosting emergency recovery;
- Joomla Console commands for CLI/SSH environments;
- Joomla Update System support;
- administrator interface available in English, German, and Bulgarian.
Shared-Hosting Recovery
TemplinTech Admin Guard is designed to operate on standard shared hosting without requiring SSH or root access.
If an incorrect configuration prevents normal administrative access, the protection layer can temporarily be bypassed by creating the following marker file:
/plugins/system/templintechadminguard/templintech-admin-guard.disable
The file can be created through the hosting File Manager, FTP, or SFTP. After the configuration issue has been corrected, the marker file must be removed to restore the protection layer.
For environments with SSH access, the package also includes a separate Console plugin with commands for status, enable, disable, and credential rotation.
Built for Current Joomla Architecture
TemplinTech Admin Guard uses current Joomla architecture, including namespaced PHP classes, service providers, Dependency Injection, concrete Joomla events, the Joomla Session API, and Joomla Console.
The extension does not rely on legacy Joomla APIs such as JFactory, JRequest, JSession, or JDatabase.
Supported environment:
Joomla 6.1.3+
PHP 8.3+
Local Security Logic Without an External Authentication Service
The core Guard functionality operates locally within Joomla and does not require:
- an external authentication API;
- cloud-based credential verification;
- remote JavaScript;
- a CDN dependency;
- telemetry;
- analytics.
Gate credentials and authorization logic remain within the local Joomla environment.
Who Is It For?
TemplinTech Admin Guard is intended for Joomla administrators, developers, agencies, and organizations that require an additional access-control layer in front of the Administrator application.
Typical use cases include:
- business and organizational Joomla websites;
- shared-hosting installations;
- VPS and dedicated-server environments;
- agencies managing Joomla websites for clients;
- systems with a limited number of administrative users;
- deployments where exposing the standard Joomla Administrator login directly to unauthenticated requests is not desired.
Use It as an Additional Layer, Not a Replacement
TemplinTech Admin Guard is not a Web Application Firewall and does not replace standard Joomla security practices.
A recommended deployment combines:
TemplinTech Admin Guard
+
Joomla authentication
+
MFA / Passkey
+
HTTPS
+
Regular Joomla updates
+
Secure hosting configurationBefore enabling Protection, the administrator should understand the available recovery procedure and verify access to File Manager, FTP/SFTP, or CLI.
Release Information
Product: TemplinTech Admin Guard
Version: 1.0.5
Status: Stable
Extension type: Joomla System Plugin + Console Plugin
Joomla: 6.1.3+
PHP: 8.3+
License: GPLv2 or later
Updates: Joomla Update System
Languages: English · Deutsch · Български
Developer: Dr. Yordan Balabanov, representing TemplinTech
TemplinTech Admin Guard 1.0.5 is now available as a stable release for Joomla administrators who want a locally managed pre-authentication access-control layer in front of the Administrator application, including a recovery mechanism suitable for standard shared hosting.
