October 28, 2026

Justflows 0.3.8: update now if your site runs on Apache

Opening DevTools on a Justflows site behind Apache could get visitors banned by Fail2Ban. 0.3.8 fixes the .htaccess rule behind it. Here is what happened, who is affected and how to update.

Justflows 0.3.8: update now if your site runs on Apache
Justflows 0.3.8 is a small release with one fix, and you should install it as soon as you can if your site runs on Apache. On those sites, a visitor who opened their browser's developer tools could be locked out of the site by Fail2Ban for ten minutes. This post explains what happened, who is affected, and how to update. The release is on GitHub.

Found by one of you

This bug was found by a user. They noticed that visitors were being blocked right after opening DevTools, traced it to Fail2Ban, and sent us a report that named the exact filter that fired. That made the cause quick to find and the fix quick to ship. Thank you. We really value that kind of commitment from the people who run Justflows: a clear report like this one helps every site on the platform, not just your own.

What happened

Every Justflows install writes a hardening .htaccess at its root. On shared hosting, Apache often serves the install folder directly, so that file stops it from handing out .env, the database file or the source code. One of its rules denied a list of file extensions, and that list included .map and .mjs. That was a mistake: Justflows serves both on purpose.
  1. Our public scripts ship with source maps, so an error in the browser points at readable code instead of minified code.
  2. When you open DevTools, Chrome requests those .js.map files on its own.
  3. Apache refused each request with a 403 before it reached Justflows, and logged it as client denied by server configuration.
  4. Fail2Ban's standard apache-auth filter reads that log line as a failed login. After a handful of them, it banned the visitor's IP address.
So nobody had to do anything unusual. Opening DevTools once or twice on a page with several scripts was enough.

Who is affected

  • Affected: sites where Apache reads the .htaccess in the Justflows install folder. That is typical for shared hosting, Plesk and cPanel (Passenger), and Apache in front of Node. The lockout needs the Fail2Ban apache-auth jail, which many hosts turn on by default.
  • Also affected, without Fail2Ban: on those same Apache sites, source maps and plugin files that end in .mjs were refused. Errors in DevTools pointed at minified code, and a plugin that ships .mjs files could not load them.
  • Not affected: nginx, Caddy, or Docker without Apache. Those servers never read the .htaccess.

What changed

0.3.8 takes .map and .mjs off the deny list. Everything else stays blocked exactly as before: dotfiles such as .env and .git, TypeScript source, configuration files, lock files, logs, database files and backups. A new test checks both directions, so source maps cannot quietly end up on the list again.
You might wonder whether source maps should be public at all. For Justflows they show nothing new: the code they map to is open source and already on GitHub.

Update now

  1. Take your usual backup.
  2. In the admin, open Updates and click Check for updates, then update to 0.3.8. Since 0.3.7, the updater builds in a staging folder and rolls back if something fails. You can also download the release ZIP from GitHub and use Upload Justflows update on the same screen.
  3. Justflows restarts by itself. On that start it rewrites the root .htaccess with the fixed rule. You don't need to edit anything.
To check that it worked, request a source map from your own site. The answer should be 200, not 403:
curl -sI https://your-site.example/js/site-chrome.js.map | head -n 1

If you changed your .htaccess yourself

Justflows only rewrites the file while its first line, the managed marker, is unchanged. If you edited that line to keep your own changes, the update leaves your file alone and you need to fix it by hand. Find the line that starts with <FilesMatch "^\.| and remove map| and mjs| from it. Do the same if you can't update today: it is a safe fix on any version.

If visitors are already banned

A ban from the default jail ends by itself after its ban time, usually ten minutes. If you run the server, you can lift one straight away:
sudo fail2ban-client set apache-auth unbanip 203.0.113.7
If your host runs Fail2Ban for you, ask them to lift the ban, or simply wait for it to end.

Questions

If something looks wrong after updating, open an issue on GitHub or a ticket on support.justflows.com. And if you spot something odd on your own site, please tell us. This release shows how much a good report helps.
Read the release on GitHub
✌️

Thanks for reading!
Find more posts on the blog or star Justflows on GitHub.