Support

Thank you for the detailed testing — the two folders you found are actually a very useful clue, and they point us at a specific, recently added feature.

First, an important safety note. Please rename both folders back to their original names (assets and services). While services is renamed, Joomla cannot load Admin Tools at all, which means your site is currently running without any of Admin Tools' protection. We have a better way to switch off the suspected feature (below) that keeps the rest of Admin Tools active.

What we believe is going on (we cannot be 100% certain yet, so please treat this as our current working theory): version 7.8.9, which you are running, introduced a new feature that immediately blocks a login attempt when someone tries to log in with a “forbidden” username — usernames like admin, administrator, test, and so on, which automated attack bots try constantly on every public site.

The problem is what happens on each of those blocked attempts: Admin Tools logs the attempt, updates its automatic IP-blocking data, and (depending on your settings) tries to send a notification email. If your server's outgoing email is slow or misconfigured, that email step can stall the request. When bots are hammering your login form — which is normal background noise for any site — those stalled requests pile up until your host (Hostinger, on LiteSpeed) runs out of PHP workers and starts returning 503 / timeout errors to everyone, including you when you try to log in. Renaming either folder simply switched this feature off, which is why the problem disappeared.

How to switch it off the safe way (this keeps the rest of Admin Tools protecting your site):

1. Log into your site's administrator.
2. Go to Components → Admin Tools → Web Application Firewall → Configure WAF.
3. Find “Immediately block forbidden username login” and set it to No.
4. Save. Then rename the two plugin folders back to assets and services.
5. Please confirm whether the 503 / timeout problem stops after this change.

To help us confirm the cause and fix it properly, could you please send us:

• A screenshot (or the list) of which options are enabled in Configure WAF.
• The contents of Admin Tools → Web Application Firewall → Security Exceptions Log — specifically, is it filling up with a large number of “Blocked username” entries? A screenshot of the last page or two is enough.
• Whether Admin Tools is set to email you about blocked requests, and whether email from your site works at all (for example, do you receive Joomla's own emails such as password-reset messages?).
• If your host lets you see it, the PHP error log from around the time a 503 happens.

Once we have this, we can tell you definitively what is happening and, if it is the bug we suspect, prepare a corrected version for you to test.