Support

Let's make sure that the problem is indeed caused by Admin Tools. In order to do so, try the following:

1. Try setting the Error Reporting level in your Global Configuration to "None". Many errors are caused by harmless PHP Notices and Warnings being output to the browser, breaking anything which requires HTTP header manipulation such as Joomla!'s session management, AJAX calls and download systems.

2. Try to replicate the issue after disabling the "System - Admin Tools" plugin. If you can still replicate the issue, it is not caused by Admin Tools. Disabling that plugin means that Admin Tools code (including the Web Application Firewall) is not running on your site.

3. If you suspect an issue with the .htaccess file, replace its contents with the contents of the stock htaccess.txt file shipped with every version of Joomla!. If you are on GoDaddy please wait for 1-30 minutes for the changes to be effective. Then, retry loading the problem page. If you can still reproduce the error, then it is not caused by .htaccess Maker.

If doing any of the above resulted in the issue still occurring, it's not related with Admin Tools and we can't help you. If doing any of the above did stop the issue from occurring, we'll have to do some troubleshooting.

First go to Admin Tools, Web Application Firewall, Configure WAF. Make sure "Log security exceptions" is set to Yes; if it's not, set it to Yes and click on Save. Now try reproducing your issue. Immediately after that, please go to Admin Tools, Web Application Firewall, Security Exceptions Log. The latest log entry at the top should have the date and time of when the issue occurred. Please copy the Reason and Target URL here so that we can further help you.

If, however, you do not see a log entry, or the Date and/or IP address do not match your last access, this problem is not caused by Admin Tools' WAF. In this case, you will have to do some .htaccess troubleshooting. You may need to read the general .htaccess troubleshooting page, as well as the page on finding out necessary .htaccess exceptions.

We followed all of the instructions, and the problem still exists. We have 13 pages of Security exceptions. The latest was 95.145.188.195 Admin Query String http://nohoartsdistrict.com/administrator/ which is my IP address.

This just tells me that you tried to log in to your site's backend without providing the secret URL parameter. This doesn't help solving your issue.

Please remember that you have to take a look at the security exceptions log right after you reproduce the issue in the site's front-end. Otherwise you will be giving me a security exception unrelated to your issue which doesn't help me help you.

Just to clarify: when you disable Admin Tools, per the instructions I gave you, does the problem go away or can you still reproduce it?

OK, I took a look at your site (I only just realized you sent me the link to your site in your first post) and I could immediately see that you didn't follow all of my instructions. You seemed to have missed the instructions in the last paragraph :) Following these instructions I can see that the blocked URLs look like this:

http://nohoartsdistrict.com/modules/mod_raxo_allmode_k2/tools/tb.php?src=%2Fmedia%2Fk2%2Fitems%2Fsrc%2F66f2a9f66e48d837f8d9568e3aa7d8b3.jpg&w=150&h=125&zc=1

This tells us that we need to allow direct access to the file modules/mod_raxo_allmode_k2/tools/tb.php How you do that is also in the document I linked in that last paragraph. Go to Components, Admin Tools, .htaccess Maker and add the following line at the end of the "Allow direct access to these files" area:

modules/mod_raxo_allmode_k2/tools/tb.php

Now click on the Save & Create .htaccess button in the toolbar at the top of the page to apply your changes.

You're welcome!