Instead of exposing the standard Administrator login flow directly to every unauthenticated request, TemplinTech Admin Guard allows administrative access to be placed behind an individually generated Gate URL and a separate Access Key. Once the Guard layer has been passed successfully, authentication continues through Joomla's standard login process, including MFA or passkeys when enabled.

The extension is designed for current Joomla architecture and supports shared-hosting environments as well as VPS and dedicated-server installations.

Key features
- Pre-authentication access control for the Joomla Administrator application
- Individually generated Gate URL and separate Access Key
- HTTP 404 and 403 response modes for unauthorized Administrator requests
- Optional redirect of unauthorized requests to the site homepage
- HTTPS enforcement
- Local rate limiting for failed Access Key attempts
- Optional IPv4, IPv6 and CIDR allowlisting
- Trusted reverse-proxy support
- Credential rotation
- Joomla session regeneration after successful Guard authorization
- Joomla CSRF protection for administrative actions
- Emergency recovery for shared hosting through File Manager, FTP or SFTP
- Joomla Console commands for environments with CLI/SSH access
- Joomla Update System support
- Administrator interface in English, German and Bulgarian

Shared-hosting recovery
Admin Guard includes a filesystem-based recovery mechanism intended for environments where SSH access is not available. If a configuration issue prevents access to Joomla Administrator, protection can be temporarily bypassed by creating the following marker file:
/plugins/system/templintechadminguard/templintech-admin-guard.disable

After the configuration has been corrected, the marker file must be removed to restore protection.

Architecture
TemplinTech Admin Guard is developed for Joomla 6 using namespaced PHP classes, service providers, Dependency Injection, Joomla events, the Joomla Session API and Joomla Console. The extension does not rely on legacy Joomla APIs such as JFactory, JRequest, JSession or JDatabase.

The core Guard functionality operates locally within Joomla and does not require an external authentication service, remote JavaScript, a CDN, telemetry or analytics.

Scope
Admin Guard is intended to complement, not replace, Joomla's built-in security mechanisms. It should be used together with HTTPS, strong Administrator credentials, MFA or passkeys, regular Joomla and PHP updates, and appropriate hosting or server security.

The extension is not a Web Application Firewall. As a Joomla plugin, it protects requests handled by the Joomla Administrator application, but it cannot independently block static files served directly by the web server without bootstrapping Joomla.

Requirements:
Joomla 6.1.3 or later supported release
PHP 8.3 or later supported release

License: GPLv2 or later
Developer: Dr. Yordan Balabanov, representing TemplinTech