Active Shield: official security fixes for end-of-life CMS releases
The client has no budget to migrate, but the site stays online and the vulnerabilities published after end of life stay open. Active Shield applies the official fixes released since then, backported file by file to the site's version.
An end-of-life site still gets attacks, but no patches.
Joomla 3 reached end of life in August 2023, and PrestaShop 1.7 stopped at 1.7.8.11 in December 2023. Vulnerabilities found later are public, with the fix for the newer versions.
Applying the patches of newer versions to an old site by hand takes time and skills that nobody wants to spend on a site waiting to be migrated.
How it works.
Fixes from official releases
Each patch starts from the vendor's official diff. Differences due to the older version are written in the manifest.
Checked before writing
The agent compares every file with the one in the official release. If one was changed, is missing or isn't writable, nothing changes and the dashboard lists the files to sort out.
On and off
Turn it on from the site's Security tab. If a core reinstall puts the original files back, the next sync fixes them again. Turning it off puts the official files back.
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
The site runs Joomla 3.9 or PrestaShop 1.7.6. Does it work?
First update it to the last release of its branch: Joomla 3.10.12 or PrestaShop 1.7.8.11. Both updates have the same PHP requirements. A Joomla eLTS site, 3.10.13 or later, already has the eLTS fixes.
Does it replace the migration?
No. It covers known vulnerabilities that have an official fix to backport. The site stays on software that gets no development, and the migration still has to happen.
What happens if I restore a backup?
A backup taken before Active Shield was on puts the official files back. On the next sync Active Shield fixes them again.
Can the extension rules block legitimate requests?
A Super User in the administrator is never filtered. A blocked request gets a 403, and the dashboard records the rule and the part of the request, without the content. You can set a rule to log only.
Goes well with
- Security patches for Joomla 3.10.12, after end of lifeThe 12 eLTS CVEs and 19 later fixes, on Joomla 3.10.12.
- Security patches for PrestaShop 1.7.8.11PrestaShop 8 fixes backported to 1.7.8.11, all or nothing.
- Vulnerable Joomla 3 extensions, when the fixed release no longer installsPhoca Download 3.2.x and Sourcerer before 16.0.0 on Joomla 3.
- Joomla 3 has reached end of life: how to protect the sites still running itMonitoring, integrity and backups on Joomla 3.9 and 3.10, even with PHP 7.1.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.