Cybersalt Page Protector is a free Joomla 5 / 6 extension that puts a quick browser check in front of the pages and modules you choose. A real visitor's browser solves a small proof-of-work puzzle in about half a second, gets a pass, and browses normally from then on. A scraper pulling thousands of pages has to pay that cost over and over, and a scraper that doesn't run JavaScript never gets the content at all. It uses Joomla's own captcha system, so there is no third-party service and nothing for your visitors to sign up for.
Why this exists
Scrapers copy public pages in bulk, and the usual ways to stop them all have a catch. Putting the content behind a login turns away the visitors you want. A full captcha on every page annoys people and usually means sending your visitors to Google or Cloudflare. Firewall rules only work once you already know which addresses to block. Joomla 6.1 added a Proof-of-Work captcha that runs quietly in the browser, and Page Protector uses it to guard whole pages and individual modules. You choose what's protected, and a person passes once and doesn't see the check again for the rest of the day.
What's in the package
One ZIP installs two extensions that work together.
| Element | Type | Job |
|---|---|---|
com_cspageprotector |
Component | The dashboard, the event log, all of the settings, and the check page itself. |
plg_system_cspageprotector |
System plugin | The gatekeeper. It decides on every request whether the visitor gets the page, the check, or a placeholder in place of a protected module. |
What it can do
| Feature | What you get |
|---|---|
| Protect pages | Pick the menu items to protect, or protect the whole site and pick the ones to leave open. The check appears inside your own template at the same address, and it also covers the same content reached through a different menu item or a plain index.php link. Blog and featured lists, tag lists and article modules show a short notice in place of a protected article's text. |
| Protect modules | Pick individual modules or whole module positions, such as a footer with your contact details. Visitors who haven't passed see a Show content button that runs the check right inside the module, or the module is hidden completely. A page never shows more than one check. |
| One pass for the whole site | After passing once, a visitor gets every protected page and module for as long as you set, 24 hours by default. The pass is a signed cookie tied to the visitor's browser, so a copied pass doesn't work for a crowd of scrapers. You can reset every pass from the dashboard. |
| Who skips the check | Logged-in users or chosen user groups, IP addresses and ranges you allow, and genuine search engines. Google, Bing and the other big ones are confirmed with a reverse DNS lookup, so a scraper that only claims to be Googlebot is still checked. AI crawlers such as GPTBot and ClaudeBot aren't on the list. |
| Feeds and caching | Feeds and other non-page formats get a 403 instead of protected content. Protected pages are kept out of Joomla's page cache, and while modules or articles are protected Joomla's module and view caches are bypassed too, so a verified visitor's copy is never served to a scraper. |
| Dashboard and event log | Health checks, the last 24 hours at a glance, and the addresses that get challenged most without ever passing, which are usually scrapers. Copy an address (or its range) straight into your firewall. The event log has a filter for every column, plus a CSV download and a plain-text dump for support requests. |
| Privacy | IP addresses in the log are shortened by default (203.0.113.0 instead of 203.0.113.7), which keeps the log friendlier to rules such as GDPR. Nothing about the extension or Cybersalt is shown to your visitors. |
| Other captchas | Any captcha plugin installed in Joomla can be chosen instead of Proof-of-Work, for example reCAPTCHA or a Cloudflare Turnstile plugin. |
| Languages | 17 languages: English, Dutch, German, Swedish, both Norwegian written forms, Spanish, French, Italian, Brazilian Portuguese, Russian, Polish, Czech, Greek, Japanese, Simplified Chinese and Turkish. |
Installing it
You'll need Joomla 5 or 6 and PHP 8.1 or later. The Proof-of-Work captcha comes with Joomla 6.1, so on Joomla 5 or 6.0 you'll pick another captcha plugin in the settings.
- Download the ZIP with the button above.
- In Joomla admin, go to System โ Install โ Extensions and upload it. The installer switches on the gatekeeper plugin and, on Joomla 6.1 and later, the Proof-of-Work captcha.
- Open Components โ Cybersalt Page Protector to see the dashboard.
Using it
Nothing is protected until you choose what to protect, so installing it changes nothing on your site.
- Click Options and pick the menu items to protect on the Protection tab. Use the Modules tab for modules or whole positions.
- Save, then open one of those pages in a private browser window. Logged-in users skip the check, so you won't see it in the window where you're logged in.
- Come back to the dashboard. The first challenges and passes show up there, and after a day or two the list of most-challenged addresses starts to show you who's scraping.
If your site is behind Cloudflare or another proxy, set Visitor IP comes from on the Exemptions tab. The dashboard warns you when it looks like you need to.
What it can and can't do
A proof-of-work check raises the cost of scraping. It doesn't make scraping impossible, because a determined scraper running a real browser can solve the puzzle too. It just has to pay for every pass it collects, and the dashboard shows you where it's coming from so you can block it. Smart Search results can still show the short extract Joomla saved when it indexed an article. Scrapers also keep changing, so if something must never be copied, the safest place for it is off the public internet.
Permissions and security
The dashboard and log have their own permissions. Managers can view them, Administrators can also clear the log, and only Super Users can reset every visitor's pass. A proxy's IP header is only believed when the request really comes from that proxy (Cloudflare's own addresses, or the proxies you list), so nobody can fake an allowed address by sending their own header.
Open source
Cybersalt Page Protector is open source under GPL-2.0-or-later. The full source, issue tracker and release downloads live at github.com/cybersalt/cs-page-protector.
Add comment