feat(security): on-demand security audit with score grading #264

New Issue

2026-06-23T17:02:40Z

jmiller commented

2026-06-23 17:02:40 +00:00

Security Audit Scanner with Score Grading

Overview

Comprehensive on-demand security audit that checks Joomla configuration, server configuration, file permissions, and known vulnerabilities. Produces a single letter/numeric grade. Comparable to RSFirewall System Check.

Audit Categories

Joomla Configuration: Default admin username, DB password strength, error reporting level, force HTTPS, session lifetime, debug mode, cache handler, SEF URLs

Server Configuration: PHP version, dangerous functions disabled, open_basedir, display_errors, expose_php, allow_url_fopen/include, upload_max_filesize, session save path

File System: configuration.php permissions, tmp/logs protection, .htaccess present, no PHP in uploads, correct directory ownership

Extension Security: No known-vulnerable extensions (VEL database), all up to date, no orphaned extensions, update servers reachable

Scoring

Each check: Pass (0), Warning (1), Fail (2), Critical (3)
Overall grade: A (95+), B (80-94), C (65-79), D (50-64), F (below 50)
Grade badge on dashboard info bar and in HQ heartbeat

Architecture

Component view with grouped scan results
AJAX endpoint for running scan
Results cached until next scan
Scheduled scan option via task plugin

## Security Audit Scanner with Score Grading ### Overview Comprehensive on-demand security audit that checks Joomla configuration, server configuration, file permissions, and known vulnerabilities. Produces a single letter/numeric grade. Comparable to RSFirewall System Check. ### Audit Categories **Joomla Configuration:** Default admin username, DB password strength, error reporting level, force HTTPS, session lifetime, debug mode, cache handler, SEF URLs **Server Configuration:** PHP version, dangerous functions disabled, open_basedir, display_errors, expose_php, allow_url_fopen/include, upload_max_filesize, session save path **File System:** configuration.php permissions, tmp/logs protection, .htaccess present, no PHP in uploads, correct directory ownership **Extension Security:** No known-vulnerable extensions (VEL database), all up to date, no orphaned extensions, update servers reachable ### Scoring - Each check: Pass (0), Warning (1), Fail (2), Critical (3) - Overall grade: A (95+), B (80-94), C (65-79), D (50-64), F (below 50) - Grade badge on dashboard info bar and in HQ heartbeat ### Architecture - Component view with grouped scan results - AJAX endpoint for running scan - Results cached until next scan - Scheduled scan option via task plugin

jmiller added this to the v03.00.00 milestone 2026-06-23 17:02:40 +00:00

jmiller commented

2026-06-23 17:02:42 +00:00

Branch created: feature/264-feat-security-on-demand-security-audit-w

git fetch origin
git checkout feature/264-feat-security-on-demand-security-audit-w

Branch created: [`feature/264-feat-security-on-demand-security-audit-w`](https://git.mokoconsulting.tech/MokoConsulting/MokoSuiteClient/src/branch/feature/264-feat-security-on-demand-security-audit-w) ```bash git fetch origin git checkout feature/264-feat-security-on-demand-security-audit-w ```

Sign in to join this conversation.

Priority Medium

Type Feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoSuiteClient#264