Changelog

1 September 2026

Addition: stealth mode, a third action on failure. Instead of a message or a redirect the visitor gets the 404 page of your own site, with a 404 status code, so the administrator area looks like it does not exist to scanners. The page is fetched from the front end once an hour and cached, so it is the real error page of your template; when the front end cannot be reached that error page is rendered from the backend instead
Security: the backend is now locked again after too many wrong attempts from the same visitor, so the key can no longer be guessed by trying one address after another
Security: access granted with the key is now tied to the visitor and expires after twelve hours, instead of staying open for the whole browser session
Security: after the key is accepted you are sent on to the clean backend address, so the key no longer stays visible in the address bar, the browser history or in links you click from that page
Security: the key is only accepted from the web address itself, no longer from a submitted form
Security: an unusable value in a proxy header can no longer be used to write misleading lines into the extension log
Security: the helper plugin for update logging is only installed when the update server supplies a valid checksum for it, and only from the Joomill update server

1 August 2026

Change: the entire code base now complies with the official Joomla coding standard (the PSR-12 based Joomla CMS ruleset); code style only, no functional changes
Change: the installer script was modernized to an anonymous class implementing Joomla's InstallerScriptInterface, removing the last legacy (non-namespaced) class
Change: the build script (build.php, dev-only, not shipped) now also passes the Joomla CMS phpcs ruleset: control structure spacing, file header spacing and a PSR1 side effects annotation
Language: es-ES language (thanks to Andrés Restrepo | alamarte.com)

7 July 2026

Addition: Downloads from the Joomill update server now include diagnostic request headers with site and environment information

2 July 2026

2 June 2026

Security: Fixed a whitelist bypass. If your site runs behind a reverse proxy or load balancer, enable Behind Load Balancer in Joomla's Global Configuration (Server tab) so the forwarded IP is honoured again.
Change: More reliable detection of whether the access key is present in the URL. Your existing key links (?yourkey) keep working exactly as before.
Fix: Internal code modernised for Joomla 6

29 September 2025

Change: Migrate the plugin to a namespace-based structure, update to Joomla coding standards, and improve modularity with helper and exception classes.
Language: language localization improvements and update plugin metadata.

24 August 2025

26 February 2025

22 October 2023

Documentation: Access Key plugin