Access forbidden during Joomla update

P2W · 2026-08-18T20:10:24+00:00

Hi Pascal, habe diverse Webseiten die nicht via htprotect.app gemanaged werden. Es ist lediglich die HTProtect Extensions installiert und Konfiguriert. Auf diese Webseiten mache ich das Core Update manuell ganz normal via Joomla Update. Leider funktioniert dies nicht mehr und generiert ein Fehler. Hat es einen zusammenhang da es nicht über das Remote Controll läuft? 🙄

P2W

Hi Pascal, I have several websites that are not managed via htprotect.app.
Only the HTProtect extension is installed and configured.
For these websites, I do the core updates manually through the Joomla update as usual.
Unfortunately, this no longer works and throws an error.
Could it be related to the fact that it’s not running through Remote Control? 🙄

P2W

UPDATE: the .htaccess file under /administrator/components/ is blocking the Core Update.
I renamed it via FTP and TaDa Manual Core Update works...

Pascal

The HTProtect extension does not create administrator/components/.htaccess

What does it look like? Maybe a leftover from an attack? That's a pretty typical symptom.

Some variants are detected by the malware scanner. So please post the exact contents or attach it as a .txt file.

P2W

Pascal I sent it to you via email...

Pascal

Thanks. That really is an HTP Dirshield .htaccess.

What does it say under the pages at
Upload Folder Hardening
in the advanced shield settings?

Did you add anything yourself there?
Normally, it should only list images, media, and files.

I'm just checking if /administrator/components ever got included in some ancient version.

P2W

Pascal
Yeah, I actually have administrator/components in there 😁
But I kinda copied that straight from your [(https://htprotect.org/demo/shield)] page 😇
So can I just go ahead and remove it everywhere then?

Pascal

Wow, the Demo Builder really messed up with that crappy example. 🫣 Great find, thanks.

In the 126 archived HTProtect versions, that was never part of the default setup, I just double-checked. 😅

I'll update the demo when I get a chance and the new versions will have strict exclusions for that.

P2W

Okay, then I'll go ahead and remove it everywhere again 😂
FYI: When you remove the entries in the advanced shield settings, the .htaccess file stays put,
in my case administrator/components, the .htaccess file has to be deleted via FTP...
UPDATE: templates was also in there, but that one gets properly deleted after removing the entry.

Pascal

It's already included in the 2.6.16 test build. It will be released tomorrow afternoon – until then, I'm still gathering more.