A pre-authentication access-control layer for the Joomla Administrator application.
TemplinTech Admin Guard is a Joomla System plugin that adds an additional access-control step before the standard Joomla Administrator login flow.
When protection is enabled, direct requests to the Administrator application can be rejected with an HTTP 404 or 403 response, or optionally redirected to the site homepage. Authorized access is performed through a dedicated Gate URL followed by a cryptographically generated Access Key.
After successful Admin Guard authorization, the request continues to Joomla's standard authentication system. The extension does not replace Joomla user accounts, passwords, Multi-Factor Authentication, or passkeys.
Access Control Before the Joomla Administrator Login
In a standard Joomla installation, the Administrator application is normally reachable at:
https://example.com/administrator/
TemplinTech Admin Guard evaluates Administrator requests early in the Joomla application lifecycle and applies its access policy before the standard Administrator login form is presented.
With the recommended configuration, a direct request to:
/administrator/
returns an actual:
HTTP 404 Not Found
without rendering the Joomla Administrator interface.
Authorized access instead begins with an individually generated Gate URL:
https://example.com/administrator/?templintech-admin-guard=g-...
A separate Access Key must then be supplied before Joomla Administrator authentication becomes available.
Features
- pre-authentication access control for the Joomla Administrator application;
- HTTP 404 response mode for unauthorized direct requests;
- HTTP 403 response mode;
- optional redirect to the site homepage;
- cryptographically generated Gate ID and Access Key;
- the Access Key is not stored as a recoverable plaintext secret;
- Joomla CSRF token validation for administrative actions;
- Joomla session identifier regeneration after successful Guard authorization;
- HTTPS enforcement;
- local rate limiting for failed Access Key attempts;
- optional IPv4, IPv6, and CIDR allowlisting;
- controlled trusted-proxy support;
- credential rotation;
- shared-hosting emergency recovery through File Manager or FTP;
- Joomla Console commands for CLI/SSH environments;
- Joomla Update System support;
- English, German, and Bulgarian administrator interface.
Designed to Work on Shared Hosting
TemplinTech Admin Guard does not require root access, a VPS, Redis, Memcached, or an external authentication service.
For environments without SSH access, the extension provides a filesystem-based recovery mechanism. Protection can be temporarily bypassed by creating a marker file through the hosting File Manager, FTP, or SFTP:
/plugins/system/templintechadminguard/templintech-admin-guard.disable
This provides a recovery path if an incorrect Guard configuration prevents normal access to Joomla Administrator.
For hosting environments with CLI access, the package also includes a Console plugin providing status, enable, disable, and credential-rotation commands.
No External Runtime Authentication Dependency
The core Guard functionality operates locally within Joomla and does not require:
- an external authentication API;
- a cloud verification service;
- remote JavaScript;
- a CDN;
- telemetry;
- analytics.
Gate credentials and authorization logic remain within the local Joomla environment.
Built for Current Joomla Architecture
TemplinTech Admin Guard is developed for Joomla 6 using namespaced PHP classes, service providers, Dependency Injection, concrete Joomla events, the Joomla Session API, and Joomla Console.
The extension does not rely on legacy APIs such as JFactory, JRequest, JSession, or JDatabase.
Supported environment:
Joomla 6.1.3 or later supported release
PHP 8.3 or later supported release
Intended Use
TemplinTech Admin Guard is intended for Joomla administrators, developers, agencies, and organizations that want an additional access-control layer in front of the Administrator application.
Typical use cases include:
- business and organizational Joomla websites;
- sites administered by a limited number of authorized users;
- Joomla installations on shared hosting;
- VPS and dedicated-server environments;
- agencies managing multiple Joomla installations;
- deployments where exposing the standard Administrator login form directly to unauthenticated requests is not desired.
Because an incorrect configuration can prevent administrative access, the extension should be configured by a user who understands the available recovery procedure.
Use It as Part of a Layered Joomla Security Configuration
TemplinTech Admin Guard does not replace Joomla's built-in security mechanisms.
A recommended deployment combines:
TemplinTech Admin Guard
+
Joomla authentication
+
MFA / Passkey
+
HTTPS
+
Regular Joomla updates
+
Secure hosting configurationThe extension is not a Web Application Firewall and cannot protect a website from a compromised hosting account, a vulnerable third-party extension, or a compromised web server.
Important Scope Note
TemplinTech Admin Guard protects requests handled by the Joomla Administrator application. As a Joomla plugin, it cannot independently block static files that the web server may serve directly from locations under /administrator/... without bootstrapping Joomla.
Complete web-server-level restriction requires appropriate Apache, Nginx, reverse-proxy, hosting-firewall, or WAF configuration.
TemplinTech Admin Guard 1.0.5
Extension type: Joomla System Plugin + Console Plugin
Status: Stable
Joomla: 6.1.3+
PHP: 8.3+
License: GPLv2 or later
Updates: Joomla Update System
Languages: English · Deutsch · Български
Developer: Dr. Yordan Balabanov, representing TemplinTech
TemplinTech Admin Guard adds a locally managed pre-authentication access-control layer in front of the Joomla Administrator application, including a recovery path suitable for standard shared-hosting environments.