The delivery.example.com subdomain is not a separate site. It's just a CNAME alias for your regular site www.example.com. Eventually it's just your main Joomla application which loads. Your problem has nothing to do with the use of a subdomain. It has to do with AcyMailing using static resources (JavaScript, CSS, images) located under the /administrator directory from the public frontend of the site.
As I have been telling them ever since they released their first version, this is WRONG and against Joomla's security best practices. Ever since Joomla 1.5, released in 2007 (15 years ago!), Joomla asks that all extensions put their static media files in a subdirectory of the media folder named after the extension's internal Joomla extension name. For AcyMailing that would be /media/com_acymailing, NOT /administrator/components/com_acymailing.
AcyMailing chooses to ignore this best security practice. Well, in two years Joomla 5 will be released and it will forcibly prevent access to static media files outside /media, /images and user-defined media source roots. AcyMailing will stop working because at this point they will have failed to heed fundamental security advice for fifteen years straight. I kept telling them they need to do it, they kept ignoring my advice on their risk and peril. I've been contributing security features to Joomla the past 13 years, I actually know about this stuff.
Anyway, there is a workaround for you right now. What you need to do is go to your site's administrator, Components, Admin Tools for Joomla and set “Administrator resources to protect” to “All PHP files”. This allows static media files to be accessed from the front-end.
You should really tell AcyMailing to stop including static media from the administrator directory. You may want to link them to this ticket reply. I am pretty sure they are completely unaware that their precarious solution will fall apart in two years' time when Joomla includes the Content-Security-Policy headers by default in new installations. Maybe this will finally give them the sense of urgency they need to fix their software. If not, well, Darwinian evolution is a thing in software too.
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!
