Support

> i setup my Administrator secret URL parameter but i have the same administrator path but i have password.

I apologise, I am not entirely sure what you are trying to say because of the two "but" clauses in this sentence. I will do my best answering what I understand you are asking based on your wording and my experience answering Admin Tools tickets.

If you mean that you can still access your site's administrator as /administrator (instead of /administrator/?SECRET_WORD) then yes, this is intentional, as long as you are using the same device and browser you have previously used to successfully view the administrator login page and you have not explicitly used the "Log out" link in Joomla administrator's User Menu to log out of the administrator backend of your site.

This is an intentional feature. It prevents you from accidentally locking yourself out of your site if you step away from your computer for a period of time longer than Joomla's session timeout (default: 15 minutes) and then try to continue working on an already open administrator page.

It will be a bit confusing if you just closed all of your administrator tabs and come back to your site a couple of hours later, or even the next day, and find that accessing /administrator without a secret word still works. It's because Admin Tools had set a cookie in your browser to "remember" that you had previously entered the correct Administrator URL Secret Word, but you had not explicitly logged out of your site yet.

If you want to disable this feature, of course you can. Go to Components, Admin Tools for Joomla, Web Application Firewall, Configure WAF, Basic Features. Set "Browser cookie override for the administrator secret URL parameter" to "Disabled". Please note that this WILL result in you or other backend users getting your IP addresses temporarily blocked if your Joomla session expires and you still have administrator pages open in your browser. That's the whole reason we introduced this feature. If you'd like to see a message reminding you that you should really be logging out of your site when you are done you can set this option to "Enabled, remind to use the full URL".

If you are worried about security, don't. It's a very secure feature as explained in https://www.akeeba.com/documentation/admin-tools-joomla/web-application-firewall.html#waf-configure-basic-protection. If you are using a shared computer / tablet using the same local computer user account as other users (which is in itself very insecure, so please don't do that!), just remember to log out of your site when you are done with administrative tasks. This removes the cookie which bypasses the Administrator Secret URL Parameter as you can read in the documentation page linked above.