HTProtect: Extension update rolled back

Tom · 2026-08-07T20:00:41+00:00

Hi Pascal, dies ist entweder ein Bug Report oder ein Feature Request, je nach dem beabsichtigten Verhalten von HTProtect. Ich nutze auf meiner Website einen anderen Mechanismus, um den Backend-Zugang abzusichern, als den zusätzlichen Passwort-Schutz von HTProtect. Aus diesem Grund habe ich den Backend Access Schutz von HTProtect auch nicht aktiviert. Das führt nun nicht nur dazu, dass der System & Self Test nur "3 of 4 passed" ergibt (Backend reachable (401 = password protection active) liefert "Check"), sondern (vermutlich) auch dazu, dass automatische Erweiterungs-Updates gleich wiederholt zurückgerollt werden und ich diese Updates manuell vornehmen muss. Wenn dies dem beabsichtigten Verhalten von HTProtect entspricht, wäre es gut, wenn man den Backend Access Schutz über einen Schalter bewusst ausschalten könnte und wenn dann auch der entsprechende System & Self Test herausgenommen bzw. ignoriert würde, so dass ein automatisches Erweiterungs-Update auch ohne den Backend Access Schutz möglich ist. Gruß Tom

Tom

Hi Pascal,
this is either a bug report or a feature request, depending on how HTProtect is supposed to behave.

On my website, I use a different method to secure backend access than the additional password protection from HTProtect. That’s why I haven’t enabled HTProtect’s Backend Access protection.

This not only causes the System & Self Test to show "3 of 4 passed" (Backend reachable (401 = password protection active) shows "Check"), but (probably) also causes automatic extension updates to roll back repeatedly, forcing me to update manually.

If this is intended behavior for HTProtect, it would be great to have a toggle to deliberately disable Backend Access protection, and for the related System & Self Test to be removed or ignored so that automatic extension updates can work without Backend Access protection enabled.

Cheers
Tom

Pascal

Hi Tom,

Which update caused the rollback?

You can already skip the /administrator password protection (just click the X at the top right → the traffic light turns green) - the fact that the self-test doesn’t acknowledge this is a bug, which will be fixed in 2.6.5.

But that shouldn’t actually be a reason for an update to roll back. I just tested it - two auto-updates still went through.

Do you have an email about the rollback reason? That definitely needs to be added to the log as well.

I’ll do some thorough testing tonight and thanks for reporting this.

Cheers
Pascal

Tom

Hi Pascal,
here’s what my Activity Log looks like right now:

    07.08.2026 18:34 rolled back HTProtect 2.6.3 → 2.6.4
    06.08.2026 21:25 updated HTProtect 2.6.2 → 2.6.3
    05.08.2026 17:39 updated HTProtect 2.6.1 → 2.6.2
    03.08.2026 18:22 rolled back HTProtect 2.6.0 → 2.6.1
    01.08.2026 21:52 updated HTProtect 2.5.15 → 2.6.0
    30.07.2026 22:15 rolled back HTProtect 2.5.12 → 2.5.15
    29.07.2026 06:05 updated HTProtect 2.5.11 → 2.5.12
    28.07.2026 18:50 updated HTProtect 2.5.10 → 2.5.11
    27.07.2026 19:58 updated HTProtect 2.5.8 → 2.5.10
    27.07.2026 18:36 rolled back HTProtect 2.5.8 → 2.5.9

On my lightweight test site, I also noticed that running the System & Self Test multiple times gives two different results:

Test - 4 of 4 passed - Status 302
Test - 3 of 4 passed - Status 403
Test - 3 of 4 passed - Status 403
Test - 4 of 4 passed - Status 302

The inconsistent results remind me of runtime effects.

Regarding the question about the rollback reason email: yes, I had it, but unfortunately deleted it after reading it and doing some tests on my own. Next time I’ll keep it.

Cheers
Tom

Tom

Today the update from v2.6.4 to v2.6.5 took place. This time successfully without any intervention from me and no rollback.
Thanks
Tom