diff --git a/core/includes/bootstrap.inc b/core/includes/bootstrap.inc
index 1a84eb4..1bb1acc 100644
--- a/core/includes/bootstrap.inc
+++ b/core/includes/bootstrap.inc
@@ -642,13 +642,13 @@ function drupal_valid_test_ua($new_prefix = NULL) {
     $test_hmac = Crypt::hmacBase64($check_string, $key);
     // Since we are making a local request a 600 second time window is allowed,
     // and the HMAC must match.
-    // @todo the additional time check appears to not add any security and can
-    // cause random test fails for long running tests. See the discussion in
-    // https://www.drupal.org/node/2771547 for why it should be removed in a
-    // future version.
     if ($time_diff >= 0 && $time_diff <= 600 && $hmac === $test_hmac) {
       $test_prefix = $prefix;
     }
+    else {
+      header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
+      exit;
+    }
   }
   return $test_prefix;
 }