Support

Just because you have an administrator directory password protection doesn't mean that nobody can get through. As I've said in my security presentations this is merely another layer of protection. A determined attacker could try to brute force that protection. Unless your password is 20 or more truly random characters, including punctuation / special characters, brute forcing it is not that hard. Remember that words and phrases in any live or dead human language (from English to Swahili and from Latin to Aramaic); or made up language (especially including Elvish and Klingon); or transcribed phonetically (e.g. pinyin) or in a weird manner (e.g. pig Latin, l33tspe4k) and so on are trivial to crack - even if you use multiple words separated by common punctuation and/or numbers.

I would recommend changing your administrator password protection with a new 24-character password generated by random.org.

That said, it appears that Admin Tools does block the brute force attack. Due to the way Joomla! processes system events the other plugin you have also gets triggered. Don't worry, you ARE protected.

Finally, do note that when Admin Tools sends you an email all dates and times are expressed in GMT. The reason is that we cannot guarantee that the execution context at the time the email is generated includes a user whose time settings are compatible with your user's settings. Instead of using a random timezone we chose to use the universal GMT timezone. Furthermore, since Admin Tools can be set up to send emails to any number of Super Users, each one with their own language and time zone settings, trying to localize the content of these emails would consume a lot of CPU and memory. In fact, the resource usage would be so substantial that it'd make sense for an attacker to perform a short but substantial burst of known to fail attacks against your site to make it overload, effectively causing a Denial of Service attack. That's a VERY real possibility that responsible security software have to mitigate. That's why, being responsible developers, we chose performance over user convenience in security exceptions handling.

You're welcome!