Open Tomxcontents opened 2 months ago
Hi @Tomxcontents, what needs to be done depends on the hosting provider. Can you visit https://yoursite.com/wp-content/plugins/app/vendor/matomo/device-detector/regexes/bots.yml
in a browser (replace yoursite.com with your website)? If you see text data in your browser, then the file is still accessible. In this case you can tell your hosting provider that the warning will go away when accessing that URL is not allowed.
I get this massage. If its good and cant access any files why the plugin write still warning?
This means the hosting provider is returning a 200-300 HTTP response code for the request to that file (which in non-technical terms means, the hosting provider is saying the request was a success, even though the file wasn't found). It should ideally be sending a 404 or 403 code (which means "not found" or "not authorized" respectively). Would you be able to share the URL here or by email? I can check whether this is the case, and if so you can let your hosting provider know. (If by email, email dizzy (at) innocraft (dot) com.)
Thank you your help!
[redacted for security reasons]
Strange, everything looks fine there. Can you provide a copy of your system report: https://matomo.org/faq/wordpress/how-do-i-find-and-copy-the-system-report-in-matomo-for-wordpress/ ?
Sure.
# Matomo
Thanks @Tomxcontents, I think I see the problem. It seems like your hosting provider blocks access to a file when a user tries to access it through the internet, but not when the server itself tries to access it. Your hosting provider could make a change to do things this way, but it's not really that important.
We'll also change the plugin to avoid this situation, but it may be a while before the change is released. For now, the issue is effectively fixed for you and you can ignore the warning.
Hi! In the diagnostics i got this warning: "The .yml files in the wp-content/plugins/matomo/app/vendor directory are accessible from the internet. This can cause some web security tools to flag your website as suspicious. If you are using Apache, it is probably due to your server configuration disabling the use of .htaccess files. If you are instead using nginx, it is due to your nginx configuration allowing .yml files. You may need to contact your hosting provider to fix this."
I wrote to my host provider to solve it, they said they did what think should be but still this the warning exist. They wrote me this: "We did whatever required from our end, still it showing same warning, it may be due to cache, by the way it's not a critical issue, still you can co-ordinate with the plugin developer and ask them what exactly they want us to disable from our server, we'll do that accordingly."
Can you be more specific how can they solve this problem? Thank you!