Support

Here I am :) Please note that I live in GMT+2 timezone, so your request came in exactly when I got back in office.

First, let me state that it is the first time I hear that Akeeba Backup has a problem with JMS multi-sites. This was solved over a year ago, when I implemented the "Dereference symlinks" option in all archiver engines. If you have it turned off (default) Akeeba Backup can backup your multisites. That said, restoring a backup means you'll be overwriting all of your sites.

Back to your questions:

1. I am not sure it has anything to do with Admin Tools. Just to be on the safe side, go to WAF configuration and blank out the following options:
a. "X-Content-Encoded-By HTTP header content for GZip compression"
b. "X-Powered-By HTTP header override (PHP version may be revealed if left blank)"
These are the only two options modifying HTTP headers

2. Without the .htaccess your site will be vulnerable. As to the technical difficulties, I have no idea if you have done something special to your .htaccess, therefore I can not comment whether it's possible or not. All I can say is: give it a try. If it doesn't work, you can still revert to your existing .htaccess (keep a copy of it!).

3. I have no idea. Can you install extensions per each individual site? If so, you can install it. Again, all I can say is to give it a go. Again, I have to say that there is no reason for Akeeba Backup to not be compatible with JMS multisites. If you have a specific backup problem, post on the Akeeba Backup forum and I will try to help.

That said, I am completely against multi-site solutions for the reasons slaes outlined. It is a VERY BAD security practice. If one of the sites is compromised, all of the other sites are compromised as well. This means that any vulnerability is amplified and every successful attack's negative impact is amplified. It's like having a car which is designed to explode on impact, killing all of its passengers. Would you ride such a car? I wouldn't!

Please try upgrading to the just-released Admin Tools 2.1.1. It should fix the issue you are experiencing.

The Admin Query String protection tries to intercept the URL, analyzing it and deducting if the secret word is set as a query parameter. If something alters the URL string before it reaches the plugin, this protection will fail. I am not sure if this is something coming from your server or the multi-site solution.

Can you post the exact error message so that I can understand the situation better?

It sounds like the multi-site solution you're using is not trly multi-site. It's more aout having one site which has all the extensions in it and only appear to have multiple sites from the outside. Unfortunately, I can't help with that because it's completely different to how Joomla! is supposed to work :(

Thanks, slaes! I had never used JMS Multisites before. I had only used another solution (whose name I can no longer remember) which was simply using symlinks for the core Joomla! files, separate databases and separate configuration.php files. That was the closest bet to a solid solution, as the only shared code was the Joomla! core, which incidentally is what Joomla! 1.7 and later strives to achieve. I won't lose any sleep over it, I have more important things to deal with :)