Cybersalt Override Checker is a free Joomla 5 and 6 extension that pairs your site with Claude AI to security-review every flagged template override — classifying real risks, ignoring the cosmetic noise, and applying the patches you confirm without leaving the Joomla admin.
The "X Changes found" problem
Joomla's native Template Manager flags every override whose core ancestor has changed after a Joomla update. It can't tell you whether the change matters — and after every point release, every template with overrides lights up at once. Signal-to-noise is zero exactly when a site owner needs to know whether their site is compromised.
Cybersalt Override Checker is template-literate. It reads Joomla's own override-tracker data, fetches both sides of every flagged override, and asks Claude to tell you what really changed.
How it works
For every override Joomla has flagged, the extension:
- Fetches the override file and the stock core file it's shadowing.
- Asks Claude to classify the drift as alert (a security regression — missing escape, removed CSRF token), review (legitimate customisation that's drifted), or info (cosmetic — copyright year, whitespace).
- Reports back in plain English, written for the site owner — not the developer.
- Applies the patches you confirm, in place, with an automatic backup of every changed file. Roll back any patch from the admin if you change your mind.
- Marks the rest as checked so the "Changes found" badge clears for everything that has been reviewed.
Two ways to run it
| Mode | What you need | How it runs |
|---|---|---|
| Manual | No API key — just your Claude subscription. | Copy the scan prompt from the dashboard, paste it into claude.ai or Claude Code, and Claude calls back to your Joomla Web Services API using your Joomla API token. It produces the report, asks what to fix, and applies the fixes through the API. |
| Automated | An Anthropic API key — pay-per-token, with hard cost caps you set in Options. | Save your key, click Run automated scan, and the server drives the whole review. A chat box on the session detail view lets you tell Claude which findings to fix — Claude applies them server-side, you watch each turn render as a chat bubble. You never leave the Joomla admin. |
What you get
- A dashboard widget that shows the override-drift count at a glance.
- A sessions log with every Claude report saved server-side.
- A File Backups view with one-click Restore for every patch ever applied.
- An Action Log of every fix, dismissal, and backup purge.
- ACL-gated Web Services API for the manual workflow.
- Multilingual UI in 15 languages — German, French, Spanish, Italian, Portuguese, Dutch, Russian, Polish, Japanese, Chinese, Turkish, Greek, Czech, and Swedish.
Requirements
- Joomla 5.0+ or 6.0+
- PHP 8.3+
- For the automated workflow only: an Anthropic API key (pay-per-token billed by Anthropic, with hard cost caps you set in the extension's Options).
Open source
Cybersalt Override Checker is open source under GPL-2.0-or-later. Free to use on as many sites as you like. Full source, issue tracker, and release downloads live at github.com/cybersalt/cs-template-integrity.
CS Remove Sample Data is a free Joomla 5 and 6 extension that detects and removes every item Joomla's Blog and Multilingual sample-data plugins install — articles, categories, tags, menus, modules, custom fields, workflows, the whole pile — with a preview, per-item opt-out, and a full activity log. One click, about 80 items gone, no leftover "same alias" collisions next time you reinstall sample data.