Frequently asked questions about HTProtect.app

HTProtect.app is a central dashboard that lets you monitor, update, scan and secure many Joomla websites from one place - conveniently via remote management. Control is zero-trust: the server runs nothing you have not signed yourself.

On its own, the free base component already protects a single website very well - firewall, malware scanner, core integrity and hardening included, ideal for a single site. The HTProtect.app dashboard adds zero-trust remote control for multiple websites, plus automatic backups, a broad toolset for time-saving remote management that batch-fixes common Joomla problems across the whole fleet, and voice and AI control.

For anyone who looks after more than one Joomla site: agencies, freelancers, associations, public bodies and administrators. The more websites you manage, the more time central management saves you.

We know of no other Joomla dashboard that combines zero-trust security, bulk actions across the whole fleet, vulnerability monitoring, a self-updating firewall, AI and voice control and a real cleanup guarantee in one - with a free base tier and a multilingual support forum. That is exactly what HTProtect is built to be: the most advanced, most fully featured management for many Joomla sites.

Classic managers store the full-access credentials of every site - a single server breach endangers the whole fleet. HTProtect stores no master key and no site password. Every command is signed in your browser; the server is only the messenger. On top of that, HTProtect is security-native for Joomla rather than WordPress-first.

In the current phase, HTProtect.app is deliberately focused entirely on Joomla - with a protection engine that knows Joomla inside out. WordPress support is planned but not available yet; today the full focus is on Joomla. Behind HTProtect stands the team at website-bereinigung.de anyway, which also cleans other systems.

Every remote command carries a cryptographic signature (Ed25519) generated only in your browser. The website checks the signature and runs only what you authorised. The dashboard server cannot forge anything - it does not know your key.

Nothing to your websites. The server holds neither signing keys nor site passwords. Even a fully compromised server cannot take over any of your sites - that is the core advantage over tools that store master keys.

No. HTProtect needs no stored administrator passwords. Pairing works through a one-time code, after which your site only ever connects outbound.

No. HTProtect is outbound-only: your site only connects outward. There is no open port and no extra attack surface - it works behind any firewall and any CDN.

No. HTProtect collects no telemetry and sells no data. It processes only what is needed to protect and manage your sites - nothing more.

It learns as a swarm. Every HTProtect instance can report missed threats and false alarms, and a short time later the whole community benefits. New detection rules roll out automatically over a live feed - just like the built-in firewall - with nothing for you to do.

Yes. Updates, malware scans, core updates, backups, hardening and tags can be triggered as a bulk action across the whole fleet - for ten or a hundred sites in one step instead of site by site.

HTProtect continuously matches each site’s extensions against known vulnerabilities. A fleet list shows you instantly which extension is vulnerable where - and you roll out the update on every affected site, manually or via an auto-update rule. For a continuously updated, public overview of all known Joomla vulnerabilities, see our Joomla CVE Feed.

Whenever you want - manually or on a schedule (for example every three days, weekly or monthly). A malware scan usually takes under a minute; comparing the Joomla core files takes only seconds.

An external heartbeat checks each site every 30 minutes from the outside. If a site goes down entirely, HTProtect notices precisely when it can no longer report in itself - and tells you.

Yes. Full and database backups run on your schedule, compressed and easy on disk space. If something goes wrong, one click brings back the last clean state.

For larger portfolios you generate an install package for mass installation or hand out a link - the sites pair themselves, with no logging into each one.

Yes. HTProtect is built for speed and overview and stays smooth whether you look after five or three hundred sites - not a list that gets slower with every site.

You connect Claude or ChatGPT to HTProtect. Then you ask in plain language for the security status of all sites, or have content maintained - your assistant reads and acts through the audited interface (MCP).

Claude (on all plans, on desktop and in the browser) and ChatGPT (in the browser, on paid plans, currently a beta). The AI features are available for websites on Joomla 4 and up.

Yes, deliberately tightly scoped. The default is read-only; you allow changes only per site, time-limited and revocable at any moment. The access never has full administrator rights, can be cut off entirely with one click, and your credentials are granted only in your own browser.

No. AI access is intentionally kept weak and strictly limited. Even a misused access would stay narrowly bounded - a takeover of your site is not possible.

Yes - the AI integration is one of our most active areas. The dashboard follows the latest developments and keeps growing; AI control for Joomla 3 is also planned. What comes next, we will announce as soon as it is ready.

The interface is available in English and German. HTProtect recognises voice commands in 11+ languages, and the support forum understands practically any language with automatic translation.

Yes. By microphone you give spoken commands like "scan all sites" or "show me the vulnerable ones" - recognised in 11+ languages. Say "log me into kunde-alpha.de" and the right one out of a hundred websites is open in two or three words. Everything is executed and displayed clearly in English or German.

There is a free base tier. Paid plans start at €3 a month and scale with the number of websites you manage. You will find all the details on the pricing page.

Yes. The free base tier includes the core features - monitoring, updates, scans and more. You only pay once you want more websites.

Billing is per workspace, based on the number of websites, securely via Stripe. You can cancel monthly.

If your website is ever hacked despite HTProtect, we clean it up - included, on every paid plan. Behind HTProtect stands the real Joomla security workshop website-bereinigung.de; the guarantee is our craft, not a marketing promise.

You install the HTProtect extension on your Joomla site, click "Add website" in the dashboard and enter the code shown. Done - no password, no port, in under a minute.

HTProtect runs from Joomla 3 to Joomla 6 and from PHP 7.4 to PHP 8.5+. AI control is available for sites on Joomla 4 and up.

In the multilingual HTProtect forum - practically any language, with automatic translation. And because a real security team stands behind HTProtect, in an emergency you are helped by people who update and repair Joomla sites every day.

Yes. You invite colleagues and give each exactly the rights they need. If you like, you enforce login by passkey only, with recovery codes as a fallback.

HTProtect is built and run by the Joomla security and support provider website-bereinigung.de (Pascal Lohmann) - with years of hands-on practice updating and repairing hacked Joomla sites.