Test environment
All tests ran on 10 October 2026 against a fresh install, made with Joomla's CLI installer, of the official Joomla 6.1.4 Full Package from the joomla-cms GitHub releases. Stack: Ubuntu 24.04.5, Apache 2.4.58 with mod_php, PHP 8.3.6, MariaDB, HTTPS with a self-signed certificate, fail2ban 1.0.2.
Each rule was checked with curl requests that recorded HTTP status codes and response headers before and after the change, plus scripted admin logins (CSRF token included), Media Manager upload attempts, and apachectl configtest/fail2ban-client -t for config syntax. Results will differ on Nginx, LiteSpeed or PHP-FPM; re-run the same requests against your own server after each change.
Not tested here: Nginx rules, Content-Security-Policy enforcement on a real template, and the full core:update flow (no newer version existed on test day).