What it checks:
- Every third-party extension against the official Vulnerable Extensions List, using your installed version. It tells you which version fixes the problem.
- Joomla itself against the Joomla Security Centre, using the versions each advisory affects.
- Extensions with an update waiting, with no update source, or with their update site turned off.
- 17 settings attackers look for: Super Users without two-step login, forgotten Super User accounts, obvious usernames, debug mode, a leftover installation folder, forced HTTPS, unsafe upload types, text filters, open registration, PHP support and more.

What you get:
- One clear result at the top and a "Fix first" list, worst problem first, with a link to the right setting.
- The evidence for every match: the listing, the name it matched on and your version. A name that is too generic to be sure about is marked as a possibility. Anything wrong can be ignored in one click.
- A result on your administrator home page.
- A scheduled task that emails you only when something new appears.
- Copy report: plain text for a client or a ticket.
- Light and dark admin themes.

Privacy: Site Lens downloads three public lists (the Vulnerable Extensions List, the Joomla Security Centre feed and php.net's supported versions). It sends nothing about your site to anyone. No account, no key, no tracking.

Limits: the lists only cover problems that have been reported, so a clean result is not a guarantee. Site Lens does not scan files for malware and does not change your site.

Requires Joomla 5 or 6 and PHP 8.1 or newer.