Support

It means that either an issue in your server or your browser prevent you from using this standard HTTP (web server and browser) feature correctly. Kindly note that this feature is not implemented by Admin Tools itself as explicitly stated in the documentation.

Please read the documentation for more information on how this feature works and what to do to disable it if you do not have access to the backend of your site.

When use any other option are you accessing your site's admin as https://www.example.com/administrator, https://www.example.com/administrator/ or https://www.example.com/administrator/index.php? Only the latter should work without an error.

Yes, this is normal.

When you visit the /administrator?something URL you are asking Apache to display the contents of the administrator directory. 

When you have selected the Everything option Apache sees that the entire directory is password protected and sends an Authorisation Required response to your browser. Your browser shows you the password prompt. Then it sends the username and password to Apache as an HTTP Basic Authentication header. Apache compares that with your configured username and password. If they checkout, Apache realises it cannot display a directory, duh! So it looks for the directory's default file. One of them is index.php. Therefore Apache tries to load /administrator/index.php?something. Since index.php is Joomla's entry point for the administrator application the rest of the process works as it should with Joomla loading and Admin Tools verifying the secret URL parameter.

When you have selected an option other than Everything and try to access the /administrator directory you get blocked because access control is on all .php files (All PHP Files option) or index.php (Joomla option). Since this was not explicitly requested Apache will tell you that you are not allowed to display the directory itself. In these cases you MUST explicitly specify index.php in the URL to login to your site's administrator backend.

That was why I asked you if you're using index.php when you said that only the Everything option works. The Everything option is directory-level password protection, the other options are file-level password protection. They are treated very differently by Apache. It's the way Apache is supposed to work.