Support

You should follow these instructions for determining any required exceptions. Most likely you need some VirtueMart exceptions, as it seems to be using stray PHP files scattered throughout its backend to do pretty much anything.

The best approach is to add exceptions for individual files. If you are lazy -like me!- you may add an exception for the folder that contains all the JS files you want to allow access to. Never, ever, allow full access (including PHP files) to a directory unless there is absolutely no other way to do that, i.e. when the file names are not predictable. Also, you should never allow access to an entire folder tree (like /components) just to get a single Javascript file working.

The back-end and front-end protection is tough to configure properly and requires a lot of trial and error. On the up side, it minimises the possibility of having a hacker install a backdoor script (e.g. a C99 variant) and use it to gain full access to your site. Even if the hacker manages to bypass all protections (like sane permissions, UploadShield, etc) he won't be able to access the malicious PHP file he uploaded. That's the true power and raîson d'être of this kind of protection.