Support

 Admin tools is an exceptional component and should be the first component installed on every Joomla site. I have used it for many years and it has proved invaluable.

This question relates to the discovery of the admin secret url parameter.
I have configured a secret parameter and also added my (fixed) ip to the admin whitelist.
I know that accessing the admin area from my ip circumvents the secret url parameter as I am in the white list, however, I am seeing attempts on the admin page that now include my secret url parameter. These are being succesfully intercepted by admin tools (becasue of the ip whitelist) and logged as security exceptions and blocked.

As my secret url parameter is a long random text string it seems unlikely that this would be guessed, so my question is how are they revealing the parameter?

As access attempts are currently being blocked because of the admin ip whitelist it is not currently a security breach. However, when I travel and need to access the site from other locations, I uncheck the 'allow only access via the admin whitelist' (as I do not know what the ip might be)
In that event, discovery of the secret url parameter is an issue.

Very Best Regards
Graham

I am running Ubuntu and Firefox with webdeveloper and adblock edge extensions. I tend to be quite paranoid about security and whilst I hear what you are saying, it is interesting that of the twenty sites I run, only one has had the secret admin url compromised.
I will investigate further, but you are confident that the url parameter cannot be discovered from the site itself, but only by security leakage at my end.
Many thanks for your prompt reply

Graham