diff --git a/public/lib/filelib.php b/public/lib/filelib.php
index 840ed79b6aa..c33e5953aa7 100644
--- a/public/lib/filelib.php
+++ b/public/lib/filelib.php
@@ -3713,6 +3713,15 @@ class curl {
             return null;
         }
 
+        // Check if the URL is blocked in core curl_security_helper or
+        // curl security helper that passed to curl class constructor.
+        // Note, we purposely check the configured helper first,
+        // as this may be being mocked for unit testing.
+        if ($this->securityhelper->url_is_blocked($url)) {
+            $this->error = $this->securityhelper->get_blocked_url_string();
+            return $this->error;
+        }
+
         // Augment all installed plugin's security helpers if there is any.
         // The plugin's function has to be defined as plugintype_pluginname_curl_security_helper in pluginname/lib.php.
         $plugintypes = get_plugins_with_function('curl_security_helper');
@@ -3731,13 +3740,6 @@ class curl {
             }
         }
 
-        // Check if the URL is blocked in core curl_security_helper or
-        // curl security helper that passed to curl class constructor.
-        if ($this->securityhelper->url_is_blocked($url)) {
-            $this->error = $this->securityhelper->get_blocked_url_string();
-            return $this->error;
-        }
-
         // Set allowed resolve info if the URL is not blocked.
         $this->curlresolveinfo = $this->securityhelper->get_resolve_info();