🐛 Bug: Unable to download csf.zip or csf.tar.gz from download.configserver.dev - 403 Forbidden

[happymanuk]

CSF › Version

15.01

CSF › Release

Stable

System › OS

Linux

System › Distro & Version

AlmaLinux 9.7

Control Panel › Name

Generic (None)

Priority

Normal

Issue Description

I've been running the previous versions of CSF for years - Currently using version 15.00.

Trying to move over to the new Aetherinox version.

When I run the following command:

wget https://download.configserver.dev/csf.zip

I get the following error:

[root@server tmp]# wget https://download.configserver.dev/csf.zip
--2026-01-03 14:29:25-- https://download.configserver.dev/csf.zip
Resolving download.configserver.dev (download.configserver.dev)... 2606:4700:3035::6815:5672, 2606:4700:3030::ac43:da95, 172.67.218.149, ...
Connecting to download.configserver.dev (download.configserver.dev)|2606:4700:3035::6815:5672|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2026-01-03 14:29:25 ERROR 403: Forbidden.

Any ideas what would cause this? - I could manually download it from my desktop and then transfer it across, but concerned this could also block it from getting updates going forward.

Steps To Reproduce

1. SSH to my Almalinux server
2. Sudo su
3. wget https://download.configserver.dev/csf.zip or curl -O https://download.configserver.dev/csf.zip

Logs › Lfd

No response

Config › csf.conf

No response

Screenshots

No response

[Aetherinox]

You are getting that error right this moment? Can you give me the last three segments of the IP you tried to download using.

XX.XX.XX

[happymanuk]

Yes, just tried again a minute ago.

XXX.182.196.19

Thanks

[Aetherinox]

Well this is even more weird. I have no IPs under that address at all which tried to access the download server.

Have you tried going to that domain in a browser under the same network and see what window you get? Or try a full wget to see the HTML of the page.

wget -qO- https://download.configserver.dev

I'm running a live log right now, try again from the machine that doesn't work, and I'll see if I can capture the attempt.

[happymanuk]

I will try it multiple times so hopefully you can catch it.

It is a server that doesn't have web browser, so can only run via the command line.

[happymanuk]

Running wget -qO- https://download.configserver.dev returns nothing at all.

[Aetherinox]

Hrm. Give me a minute, going to throw some prints in and then I'll have you try again.

[Aetherinox]

Alright, try downloading from that machine one more time. I have a log at the absolute beginning.

[happymanuk]

Thanks. I've just made 5 attempts with that message:

[root@server tmp]# wget https://download.configserver.dev/csf.zip
--2026-01-03 15:40:53-- https://download.configserver.dev/csf.zip
Resolving download.configserver.dev (download.configserver.dev)... 2606:4700:3030::ac43:da95, 2606:4700:3035::6815:5672, 172.67.218.149, ...
Connecting to download.configserver.dev (download.configserver.dev)|2606:4700:3030::ac43:da95|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2026-01-03 15:40:53 ERROR 403: Forbidden.

[Aetherinox]

OK, for some reason, this isn't the app itself. I wonder if Cloudflare is blocking you for some reason. I never record your attempts at all.

Try this on the main domain:

curl -i -L https://download.configserver.dev/?output=json

I'm going to go look through the normal CF logs and see if I can find a cause. Haven't had this happen yet.

[happymanuk]

This the results of running that command:

`[root@server tmp]# curl -i -L https://download.configserver.dev/?output=json
HTTP/2 403
date: Sat, 03 Jan 2026 15:47:05 GMT
content-type: text/html; charset=UTF-8
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cf-mitigated: challenge
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server-timing: chlray;desc="9b83a1f42e0d1c97"
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=gWNYV%2B2PCUs3N4SMJluQrKHB8RRDOi9OFIptxLUNqy99pL1W3q7iANBUNcvUPQBLctYiCvu3jIY1sH6iasR%2F4bG9mlVg2Xm%2FDBOJ2jBmf6Ej7c1Q95B8hXmdBtusN%2Fv8pP8LKObxRiZwceTXHsKMfOs8KvhHHX6X"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=0
server: cloudflare
cf-ray: 9b83a1f42e0d1c97-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1458&min_rtt=1408&rtt_var=336&sent=6&recv=9&lost=0&retrans=0&sent_bytes=3402&recv_bytes=838&delivery_rate=2736129&cwnd=253&unsent_bytes=0&cid=6bdb59cd55bfb4cd&ts=31&x=0"

<title>Just a moment...</title><style>*{box-sizing:border-box;margin:0;padding:0}html{line-height:1.15;-webkit-text-size-adjust:100%;color:#313131;font-family:system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,"Noto Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"}body{display:flex;flex-direction:column;height:100vh;min-height:100vh}.main-content{margin:8rem auto;padding-left:1.5rem;max-width:60rem}@media (width <= 720px){.main-content{margin-top:4rem}}.h2{line-height:2.25rem;font-size:1.5rem;font-weight:500}@media (width <= 720px){.h2{line-height:1.5rem;font-size:1.25rem}}#challenge-error-text{background-image:url("data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSI+PHBhdGggZmlsbD0iI0IyMEYwMyIgZD0iTTE2IDNhMTMgMTMgMCAxIDAgMTMgMTNBMTMuMDE1IDEzLjAxNSAwIDAgMCAxNiAzbTAgMjRhMTEgMTEgMCAxIDEgMTEtMTEgMTEuMDEgMTEuMDEgMCAwIDEtMTEgMTEiLz48cGF0aCBmaWxsPSIjQjIwRjAzIiBkPSJNMTcuMDM4IDE4LjYxNUgxNC44N0wxNC41NjMgOS41aDIuNzgzem0tMS4wODQgMS40MjdxLjY2IDAgMS4wNTcuMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+");background-repeat:no-repeat;background-size:contain;padding-left:34px}@media (prefers-color-scheme: dark){body{background-color:#222;color:#d9d9d9}}</style>

Enable JavaScript and cookies to continue

<script>(function(){window._cf_chl_opt = {cvId: '3',cZone: 'download.configserver.dev',cType: 'managed',cRay: '9b83a1f42e0d1c97',cH: '0Q_zdkozjuV8UBcrhsn13D78WLpjN2l3p9KTegbemMA-1767455225-1.2.1.1-rshc0R1x.YNzFPzahqk3I4KlZM6LYvcYjoocGaYr1L6GHIsinnNrfvWKFrnZ2rAe',cUPMDTk:"\/?output=json&__cf_chl_tk=lMRIZ_xWUrJDQG2eEPj7AvngpAmJbDcjl6U8LTRhfj0-1767455225-1.0.1.1-oJAYhGDlBtOZjfBG.dq3r7Tn9xYP5KWfwn8ibSkExuw",cFPWv: 'g',cITimeS: '1767455225',cTplC:0,cTplV:5,cTplB: '0',fa:"\/?output=json&__cf_chl_f_tk=lMRIZ_xWUrJDQG2eEPj7AvngpAmJbDcjl6U8LTRhfj0-1767455225-1.0.1.1-oJAYhGDlBtOZjfBG.dq3r7Tn9xYP5KWfwn8ibSkExuw",md: 'zBbr9L1exKPKS5gvSrrsocqEILuxW6r9ziGfOQueXuo-1767455225-1.2.1.1-gk89rbNzPrWiK5_2vIxZ4uYcjGkinmRUtste6jzwJtLmum9DmG7U30Z4TgRUNJFiD.rUpiicOiePhPUCmOn5J3sk3k2ZHVGLwnMPBRsuDaoW2fiMvcirwQUJuv8ZnpA1FJjQDCXWO4A49e8fmr1nYtm0yVBARgptqgxnTtsLamOYWosE_1xTbwbKVqOj.OAvDML.jaQaXBM7vttGzs5bW5URx_iUzUYRzxxM833f9_IsdnqNwuNUst2w8XpY6f_83gRFzGRmzf6rt3IqtzzcG5Bvi88woTJVgBm6BT9jnhx48GbezYgYfup4CwwDGObaoqxnLdB6_Q744_Td7p6GboJmNFwQXdxIaU5tWljvi7ciA6ePeruhMNPgieVrAIJx7RCtaQexRPjnGOVUZXrWR84neV8gb.vy2atSew3JHn2xxRUDCn3S2OTkw6ctL9ioHUHtL_jbm6mXJyfaTje4CATYQKfT_XFjtX6KI4Tnxi21sNAtfj96xgcyQqAfkH1d3z5u5Z8rTaTH95gAkbLzBa1f5Y3M.QVnVdGgkgNZj5LBsI7B4YiMu6npIcSGY.B5t6J1RSi1SKwhklZ7fN5NQM2mXpaa.ZWVva7xNZosld325_nJdCG5WUAOGBwS0G8bgdW5SpuMEdkIU0B39fojTlES3xw0tTMRgHI5GvYJSolQ.bFG2mWN1H_ENjCEL2tYKhJ0xJCCQP2LhgX5Jc8FaHfsbbqhKnBJlsOmjXaRkQbt3Zu4KM3vxcEXu8ZV4eP3FKYhg6QuIrD8JgNFzCu74THPn0H4KZAT_Uez9Mbf4v6LOLsQqXBwyKMRkDre45RBX3tdv2QEHv3y5CSUzhTsVA',mdrd: 'EXeE4AX4RylGcgNfd5WIhxIl55OLMyB4JwghuFkxaR0-1767455225-1.2.1.1-U21TVKZFZ866BTSmZ.f5mpFG8NDlGo0s4Go8mjLuel3_cKr8Y7S3KddQmG.vPDYPfmOr2cn1K_9AXpBarbmzceA6wlmRuj1Lg6MLEIc9DZkPYTAv8xXt6pZAI72DMk6oacHuIKdW1sRoSE7GALCn9SjCXdfDpbNzcl_5SjJFFql8iTU5oDErfx_jo0_6ynwhIZT_cEQq99QL.dZR.M2ozkEr.v6WtRoF92Is2mgmbatxLrKu.84ULA6v1irpHmAb1ou9DEutk8ryOMZevJT.cPR5c3FkJVbfM6vJ2Zqt5olfeO36V8KstadwX4Po8wCOG2oxpN0AZu5f9ddwdSPnpRWdUyNxZe_GMhAHu6WaAlF3DfuwEMvdzuJnTWf_rQ7NpsXlsIbzodv.CgtAhFwhoxsSoUthSRiZmAPFw6OEL2HP22SQz_5u8NP62DO4KWbkF5AHSd3EBwNKCNNfeMP09Eq1oNS2VSsFrvrFjR3N7pA8Wgb2eyKzSYGZkpyUcZ9HC0mka_JEgPemRGTmXqSIeglT3FU4WPYmLq1R5xkJxKndHOaD5Re3qW3pGh5S4aQSWx7rnxEnxRJlpmCAICgL.Ct9flVE0OtZ2WVEqDvJqql.IbW6nhe59zwWbcLXmANOgj2dctV6bIu3N.VNFAgIYGeptDGOfpVkYkCZ4XOjP.U8qv88LleEiHnqu_eDxuU7ehxQ6r_nEuMLmoMqoapRVfSHQ29J70VR7gudPWUIJI4MExfv3NPSQqmuL7YdE30p4K1WPOsvKH_jwZQYwUw5T.pSgapN0WCR3oKBnNzzKP1ZE6M2Iditkd0rnoA_rS1sYQaLsNN4beyP3ax7SckZUrmFwnPkV2_FWfCH5pobhkJ1Fqu0WyAnMEtdx5XO3vD6rYtnl9VZE7Ey1kQfYJiRVN4gVH9KXDEMH68IOHcNmaFP8AZoKKbRhUBhK5G6Gtc5revWi3aEe04SGHHju9qIfxUKFV6e0klspPPVruw0BVbDjrzMTbI0QMFA.GrnCtNwMLEaVY5WlxrFcqIjDphjIpMElORvqroZb4ap87CQBfHcOen5pNamo2czqebYxRMZTht83gy1F._W8oDxU6U7spsf0Zj0NtBee5RQM9lMCAYvMkKihV3tsC88q6_MRhDvl585odMPQ5IRXeQal30CLvxUd6NMKWinpzGpH09PWaRdAcYwHqIz4ffpDszVZZsvkf0wQeQjua_4w5cHFLILEnpzWsltfHAFJINwpCcmtdZjw1kItADreF7wZp7T40v1Q1xI82QrCTNx3SnRABDl.5GdFHYah2hL983Fo0MPIQjpr3rz_mAap3VjIiuautEhVhJ2qoQdcY4u4bJpzQgOdklYAPGtKpF9gQ567P.kSE3pFiUlnUcg9vbfb6ajtkfiBLC.xqdUzB7DxED4zMn2XWpN27k6JJszbedpuZ1gTFTR1RQ9HRAqE.EOBunY.are8knuHI52CaCAyMVm7Dk9vazlkIhF1HACWn716MGcZ4zso2EkQfWCJpYFpdNuS9bmF9puybK2pluZHblEhaYDjJrPz5fCSmX7PQQXdcwtElWCiwZfFsHrmmE9QXBzyNU7nW8a5oCt.9fea2Ran9Yx6fHH2lF44ZVRKO7yygTuNckZ_vpjiI0QkuAFYncX65DXUTfpXblJvzoexq8QCObelkN3_Urfjy65quqOLhkAYEdqwWkH4iibnubqvo0PbJzxvQ04pzPdLmKlkPPEbw2OqnCDkC4SvL2_lQgxAG87.vAJZPB1d8KeUPtajBaca4b70Bbe9404039RPGQwYqMmgc.gRtdTTghdgJZGWZpEIrbU.yz_DJI_kaIeiwWXfZbkLi0jMofrvrJsBLsPhZLs86wxNry.Hz6bDmZmEr8ruLn8rf.r_LeZC1xA.UoYrdRDjW93qlYnP5gsZRtE754oXZRmtNBBMtoLrHVvNSc4sgkXOzGEwJD4JV9aArdGzxyEB0_HZTJkeMbmdroTMAMH.gKpVTHmUMdUv7s_Gqc7R0R0vf2T.ZV0iyLK8MxANYWAz75yjYl9wg_yTtIRuoq..gn9UGuSTN311YojYccHALzAZX57tqdKcJDTGp.vRnyjMHGfYyyeypyW3mWWsTPXs0jJzpf5xmDW24g1NiFR.aZ8mY1QVLkMz6BkMrJqIh..B__XZkOM3ir4ji0AKFfvRsl.uTqXn.rsvk54zzGe3MIz2aOZXzi4JQSyBnyA42IvotGqZJCZrUPDB63kMUd2PBwIX9aAyMnFTh.L622cRUnrN.nklzBhB1rr4p9k22n_W64DC.juwW9xUklTCJKANOb_4vdG3myC1lreuOQkc14qvCae6UvOZ135p3PHdfx12Xzx568dvswpcFdbU.pd9yZzETR7rMw3XW1G0ttPJuVRt3KXuxUeai0hoievpwl47ok4JmnP5WfbNd_cmY6OP_3RyKtxmBdAwM58fF7AVmvgqn5iZ0_prW_CpK2mWKUEUppkqCeuTlnxkB7k11k.Cw',};var a = document.createElement('script');a.src = '/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=9b83a1f42e0d1c97';window._cf_chl_opt.cOgUHash = location.hash === '' && location.href.indexOf('#') !== -1 ? '#' : location.hash;window._cf_chl_opt.cOgUQuery = location.search === '' && location.href.slice(0, location.href.length - window._cf_chl_opt.cOgUHash.length).indexOf('?') !== -1 ? '?' : location.search;if (window.history && window.history.replaceState) {var ogU = location.pathname + window._cf_chl_opt.cOgUQuery + window._cf_chl_opt.cOgUHash;history.replaceState(null, null,"\/?output=json&__cf_chl_rt_tk=lMRIZ_xWUrJDQG2eEPj7AvngpAmJbDcjl6U8LTRhfj0-1767455225-1.0.1.1-oJAYhGDlBtOZjfBG.dq3r7Tn9xYP5KWfwn8ibSkExuw"+ window._cf_chl_opt.cOgUHash);a.onload = function() {history.replaceState(null, null, ogU);}}document.getElementsByTagName('head')[0].appendChild(a);}());</script>[root@server tmp]#

`

[Aetherinox]

Bot challenge. That is CF doing that. Give me a few, I thought challenges were off for that.

[Aetherinox]

Alright, I changed the settings and gave it a few minutes, try now.

[happymanuk]

Looks good to me - Thank you!

Is this likely to happen again in the future, or is that a permanent change now?

Thanks

[root@server tmp]# wget https://download.configserver.dev/csf.zip
--2026-01-03 15:55:35-- https://download.configserver.dev/csf.zip
Resolving download.configserver.dev (download.configserver.dev)... 2606:4700:3035::6815:5672, 2606:4700:3030::ac43:da95, 104.21.86.114, ...
Connecting to download.configserver.dev (download.configserver.dev)|2606:4700:3035::6815:5672|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 5553728 (5.3M) [application/zip]
Saving to: ‘csf.zip’

csf.zip 100%[========================================================================================================================================>] 5.30M --.-KB/s in 0.05s

2026-01-03 15:55:36 (104 MB/s) - ‘csf.zip’ saved [5553728/5553728]