URL Inspector
The URL Inspector monitors incoming request URIs for forbidden keywords. When a URI contains one or more of the configured words, the inspector can log the request, block the IP, and send an email alert.
The URL Inspector must be enabled separately. If it is currently disabled, a warning alert is shown with an Enable button that activates the feature without leaving the page.
Options
| Option | Description |
|---|---|
| Write Log | Records URL Inspector detections in the firewall log. |
| Action | What to do when a forbidden keyword is found in the request URI: Do Nothing (log only), Add IP to Dynamic Blacklist, or Add IP to Blacklist. |
| Send Email | When enabled, an email notification is sent each time a forbidden keyword is matched. Configure the sender and recipient in the Email Notifications tab. |
| Forbidden Words | A textarea of keywords or URL fragments to watch for, one entry per line. The inspector checks each incoming URI against this list. |
Example: to block bots probing for WordPress admin files (a common scanner pattern on non-WordPress sites), add
wp-adminto the Forbidden Words list. Any request containing that string in the URI will trigger the configured action — no valid request on a Joomla site should ever include it.
The URL Inspector scans the request URI path and query string only. It does not inspect POST body parameters — use the main firewall filters (XSS, SQL, LFI, etc.) for that purpose. Direct file accesses that bypass the CMS router are also not inspected.
