Start a Private QCDR Discovery Session

Start Discovery from the QCDR Administrator Discovery tab. QCDR creates a short-lived signed authorization for the current administrator, validates the target as a same-site frontend URL, and opens the private session in a new browser tab.

The Discovery authorization lasts 15 minutes. If it expires or fails validation, QCDR does not activate the inspector.

Before You Start

  • Effective access must include Max or All Access because Discovery is a Max-level feature.
  • Your Joomla account must be able to manage QCDR and have Run Discovery; a Super User satisfies these checks automatically.
  • Choose a normal frontend HTML page on the same Joomla site.

Launch the Session

  1. Open Components > QC Dynamic Replacer > Discovery.
  2. Enter the Frontend URL. A relative site path or normal URL on the configured Joomla site is acceptable.
  3. Optionally enter Visible phrase to find first. The launcher accepts up to 500 characters. Leave it blank to begin in click-to-select mode.
  4. Choose Open Click It, Change It.
  5. QCDR opens a new tab with the signed Discovery parameters and, when authorized, appends the private toolbar/inspector to the rendered frontend response.

Which URLs Are Rejected

The launcher accepts HTTP or HTTPS only, rejects embedded usernames/passwords, requires the same normalized site hostname and effective port, keeps the request inside Joomla's configured site root, and blocks real /administrator paths. A www/non-www variation is normalized back to Joomla's configured canonical origin.

External domains and paths outside the configured Joomla root are rejected before the Discovery tab is opened.

How the Authorization Is Protected

The token is signed with a site-derived HMAC key and contains the authorized Joomla user ID, expiration time, and a random nonce. The frontend validates the signature, expiration, user, current account state, QCDR plan gate, and Discovery permissions. Authorization fails closed if any of those checks no longer pass.

QCDR marks the response private, no-store, no-cache, adds noindex/nofollow/noarchive, disables Joomla page caching for the request, and sends Referrer-Policy: no-referrer.

If the Session Expires

An expired or invalid request shows a Discovery-not-authorized panel instead of the inspector. Return to the QCDR Discovery tab, reload it while signed in with the correct administrator account, and launch a fresh session. Do not copy or manually extend an old authorization URL.

Exit Cleanly

Use Exit Discovery when finished. QCDR removes its Discovery query parameters from the exit URL so you return to the ordinary frontend page without carrying the private session controls forward.

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDR feature? Visit the QC Dynamic Replacer Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.