Update source integrity watch

Joomla installs whatever its update sources serve. If an attacker changes an update source's address, Joomla's own updater can deliver malware with one click. The Update Source Integrity card under Settings → Analysis helps you notice that.

• Plain-HTTP sources are flagged: a network attacker can substitute the download.
• The scheduled check keeps a baseline of every update source and emails you when one is added, removed, enabled or disabled, or has its address changed. The first run records the baseline silently.

Rows link to System → Update Sites, where you can review or remove a source.

Disabled update sites and extensions with no update source are reported separately by the update-health warning, so they are not repeated here.