Hi Leandro,

Thank you for your detailed report, and we sincerely apologize for the inconvenience.

The issue you're experiencing is related to an ongoing DDoS attack targeting JoomShaper.com. To keep our services available, we have temporarily enabled stricter Cloudflare security protections, including rate limiting and browser challenge rules. These measures help distinguish legitimate browser traffic from malicious automated requests, but unfortunately they can also affect automated clients such as Joomla's extension update checker, which cannot complete the Cloudflare JavaScript challenge.

As a result, requests to the update XML endpoints may receive a Cloudflare challenge instead of the expected XML file, causing Joomla to report that it cannot access the update sites.

Please rest assured that this is a temporary measure. We are continuously monitoring the situation, and once the attack subsides, we will relax these restrictions so the update endpoints can be accessed normally again.

We completely understand how frustrating this is, especially given the recent security update. Unfortunately, these protective measures are necessary to mitigate the ongoing attack and ensure our infrastructure remains available. While we regret the impact on extension update checks, the situation is outside of our direct control as it is being caused by malicious third-party activity.

We sincerely appreciate your patience and understanding, and we're very sorry for the inconvenience caused.

Hi,

Thank you for your detailed explanation and for clarifying the situation.

I completely understand the need to protect your infrastructure during an ongoing DDoS attack, and I appreciate the work your team is doing to keep your services available.

However, I would like to share one concern from the perspective of someone managing production websites.

While the attack itself is outside of your control, the current Cloudflare protection prevents the Joomla CMS from accessing your update XML endpoints. As a result, Joomla cannot check for available updates, and administrators are unable to update extensions directly from the Joomla backend.

In our case, this had a significant impact. Our production website was compromised through a vulnerability that was fixed in a later SP Page Builder release. Because Joomla could not check for updates, we had no indication that a newer version was available, and therefore no opportunity to update the extension through the normal Joomla update process.

Perhaps you could consider an alternative approach, such as:

• Excluding the update XML endpoints from the Cloudflare browser challenge.
• Serving the update XML files through a dedicated endpoint or subdomain.
• Applying a different Cloudflare rule specifically for Joomla update requests.

These approaches would allow administrators to continue using Joomla's built-in update system while still protecting the rest of your infrastructure.

The ability to check for updates directly from Joomla is critical, especially when security fixes are involved. If the CMS cannot access the update information, production websites may unknowingly remain vulnerable until administrators manually visit your website and discover that a new version has been released.

Thank you again for the clarification and for your support. I hope a solution can be found that maintains both your security protections and the normal Joomla update experience.

Kind regards,

Leandro Lourenzo

Hi Leandro,

Thank you for your thoughtful response and for your understanding of the situation.

We completely understand your concern, and you make a very valid point. The ability for Joomla to automatically check for extension updates is indeed critical, particularly when security releases are involved.

We appreciate the suggestions you've shared regarding excluding the update XML endpoints from Cloudflare challenges or serving them through a dedicated endpoint. These are valuable recommendations, and we will forward your feedback to our development and infrastructure teams for review as we continue evaluating ways to improve our protection mechanisms while minimizing the impact on legitimate update requests.

Our goal is to strike the right balance between protecting our infrastructure from ongoing attacks and ensuring that customers can continue to receive update notifications without interruption.

Thank you again for taking the time to provide such constructive feedback. We truly appreciate your patience, understanding, and continued support. If there are any developments or improvements regarding this matter, we'll be sure to communicate them through our official channels.

Kind regards