Admin On /admin/category.php?category=security add a hostname to the curlsecurityblockedhosts Create a course with assignment activity (Online text submission type) and enrol a user Subscribed user Make a submission to assginment for the course created in Admin 2 step: Insert or edit image Browse repositories URL downloader - enter a url from the site which hostname was added to the curlsecurityblockedhosts Assert that "Blocked URL" error is displayed. Admin Go to the Logs page /report/log/index.php : Filter for User and Create actions. Assert that "Blocked URL" event is in the list. Assert that the event is logged in the web server log files. A note If during submission user does not go through URL downloader workflow, ie enters the url directly, the url is not being checked against curlsecurityblockedhosts and will not trigger a "Blocked URL" event.