Support

Admin Tools

#43408 Gemini blocked by MUAShield

Posted in ‘Admin Tools for Joomla!’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
6.1.3
PHP version
8.4.
Admin Tools version
7.9.3

Latest post by nicholas on Monday, 12 October 2026 07:06 CDT

Monday, 12 October 2026 03:51 CDT

smartweb

Hello

I’m having a problem on a client’s website where Google Gemini is being blocked when the ‘MUAShield’ option is enabled in the WAF section of Admin Tools. ChatGPT, Claude and others aren't blocked.  According to information from Gemini itself, the reason for this is:

Each provider uses its own identification strings for live searches:

ChatGPT (ChatGPT-User): OpenAI has designed its user-agent to mimic the structure of classic browsers (Mozilla/5.0...) exactly. WAF systems such as Akeeba often classify this string as ‘safe’ or as a regular browser.

Claude (Claude-Web / ClaudeBot): Anthropic uses a very minimalist but strictly formatted header, which many standard WAFs do not flag as anomalous.

Gemini (GoogleAgent-URLContext / Google-Extended): Google uses its own tokens for real-time URL retrieval. These headers are shorter, structured differently and were quickly classified by older algorithms in MUAShield as ‘non-standard / potentially spoofed client’.

As soon as I disable MUAShield, access works perfectly. Is it perhaps possible to configure MUAShield so that Gemini is no longer blocked, even when this option is enabled?

Kind regards,
S

Edited by smartweb on 2026-10-12 03:52 CDT

Monday, 12 October 2026 07:06 CDT

nicholas

This doesn't make much sense because MUAShield is there to protect against a very specific security issue which was a zero-day in Joomla some 11 years ago. It will only kick in when the User-Agent contains malicious things like "feed_url, }__ or JSimplePie. Gemini does not use any of that. It uses strings like Googlebot/2.1, Google-Agent, or GeminiCLI/<version>/<model> (platform; architecture; surface). I even checked with my own sites; nothing is blocked with MUAShield enabled using Gemini on the web and on Android. You can try that yourself with the prompt "What is https://www.dionysopoulos.me/book.html about?". That's accessing my blog which is running on Joomla 6 latest, Admin Tools latest, MUAShield enabled.

I would ask you to please look into your server's access log to understand what is the User-Agent string sent. It sounds like something really fishy is going on. What kind of Gemini integration are we talking about here? Could it be an infected device or compromised integration which is indeed trying to send the malicious User-Agent string in hopes that it will hit the PHP deserialization vulnerability which has long been patched in Joomla and defended against by MUAShield regardless?

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!