Support

You understand it backwards. The redirection to the main page actually confuses an attacker because they are not sure if it's the result of a SEO configuration on a non-Joomla! site or a Joomla! site protected by Admin Tools.

FYI, I can still tell a Joomla! site without even trying to visit the administrator URL. You can too. OK, here's the secret sauce. Open a site's front page. View the source of the page. No matter what the site owner does, there will be references to some tell-tale folders such as "templates", "images" and "media". If you are really sly, you don't even have to open a site's front-end page. Just try accessing the /media/cms/css/debug.css. Now you know my not-so-secret way of figuring out which site is Joomla! or not.

Before you ask, no, you can't block access to all tell-tale files and folders. That would brick your site. That's why we have an active firewall in Admin Tools: to prevent attacks, not to hide the fact that your site runs Joomla!. Even if you could hide all the files, nothing would stop an attacker from trying the most common exploits targetting (usually outdated) Joomla!, WordPress and Drupal sites. You know what? Even on our site which shouts that it's Joomla! we see attacks targetting old versions of WordPress every single day. No, script kiddies do not even try to guess what kind of site you have. They will just launch whatever they have at you and hope for the best. Firing at random sometimes yields results. You can't prevent random fire, you can armor up and make sure it doesn't touch you.