deployed/helix3 held only a minimal 227-line variant, missing the live
docroot customization (Google Analytics gtag, warehouse-menu logic,
HTTP_HOST domain branches) — so the malware-remediation restore stripped
these from the live site. Replace with the byte-exact live version (792
lines) with the seo-cloaking backdoor line (google-UA C2 exfil) removed.
Assisted-by: claude-code@claude-opus-4-8
Helix3 (JoomShaper) template + system/ajax plugins; the live templates/shaper_helix3/index.php was fbwjedi-cloaking-infected and is replaced with the clean monolith copy -> deployed files.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8