Support

As we have explained many times no, this DOES NOT mean that they got through. This has to do with the sequence of events in Joomla!'s load process. Joomla! will FIRST try to process a login authentication THEN process the rest of the request. This means that the load order for Admin Tools protection is FIRST the failed login notification and THEN the secret admin URL parameter, rename admin URL and so on.

However, this is NOT a security issue. If a hacker sends the correct username and password but they do not have the correct administrator secret URL parameter here's what happens. Joomla! sees the valid credentials and thinks "OK, I should switch the session and log them in". But Admin Tools sees the missing URL parameter and says "No, they have to booted off our site's administrator section". The end result? The attacker sees a 302 redirection to the site's front page and they are NOT logged in. It is the same thing that happens when they have the wrong username and password or just the wrong (or missing) secret URL parameter.

I know it's confusing to get this kind of emails, but that's how Joomla! works under the hood. It's something we can't change and even if we could I would still wouldn't touch it. There's a good reason Joomla! has this specific sequence of events taking place under the hood and I agree that it's the correct way to do it from an IT security point of view. The only thing we could do is remove the treat failed logins as security exceptions feature (just like it was several versions ago).