Support

First of all, do you get any security exceptions logged from when MIGS is trying to post back to your site? If you do, please tell me the Target URL and Reason listed there. Without this information I can't really offer any advice.

If it's not logging a security exception we have to make sure that Admin Tools has something to do about it.

If you only disable the System - Admin Tools plugin does the problem go away? If it doesn't I need you to tell me again what the perceived problem is because what you just observed doesn't match your original description and I don't know if I'm helping you with the problem you have or something entirely different.

If it does, we have to check a few things. For starters, are you using GeoBlocking? If you do then of course MIGS would be blocked if their server is outside the geographic areas you have allowed. It's very likely for a card processing company to use regional data centres e.g. an Amsterdam or London data centre for the entire EMEA (Europe, Middle East, Asia) region. I suppose card processing companies do the same for the Australia and Pacific region.

If that is not the case check all your IP blocking settings: Site IP Blacklist, Auto IP Blocking Administration, Auto IP Blocking History. Depending on your settings and actions you may have ended up auto-blocking the IP of the server(s) used by MIGS or manually added said IP to the Site IP Blacklist. Removing all records with that IP from all three of the aforementioned locations would allow you to actually see the security exception being raised, report it back to me and let me help you from there. If you tare not sure what is the IP just turn off the "Disallow site access to IPs in Blacklist" option in the Configure WAF page to force Admin Tools to ignore the Site IP Blacklist. Moreover, delete all records from the Auto IP Blocking Administration and Auto IP Blocking History pages. This will let you see the security exception being raised.

If despite that there is no security exception please do check your "Do not log these reasons" setting. Only something in that list could raise but not log a security exception.

Are you also using the .htaccess Maker feature? If you do, please do try replacing the contents of your .htaccess file with those from Joomla's stock .htaccess code. If that makes the problem go away I'd recommend checking with the payments gateway what is the user agent string they are using when they are contacting your site (post-back). Then make sure that you remove that user agent from the list of user agent strings to block towards the top of the .htaccess Maker interface before using it again to create a security-enhanced .htaccess file.