search

matomo-org / matomo-for-wordpress

Get a fully functioning Matomo Analytics for your WordPress. Star us on Github? +1. Matomo is the leading open alternative to Google Analytics that gives you full control over your data. Privacy is built-in. 100% data ownership, no one else can see your data. We love Pull Requests!
https://matomo.org
GNU General Public License v3.0
120 stars 25 forks source link

"YML files should not be accessible - warning" #1168

Open Tomxcontents opened 2 months ago

Tomxcontents commented 2 months ago

Hi! In the diagnostics i got this warning: "The .yml files in the wp-content/plugins/matomo/app/vendor directory are accessible from the internet. This can cause some web security tools to flag your website as suspicious. If you are using Apache, it is probably due to your server configuration disabling the use of .htaccess files. If you are instead using nginx, it is due to your nginx configuration allowing .yml files. You may need to contact your hosting provider to fix this."

I wrote to my host provider to solve it, they said they did what think should be but still this the warning exist. They wrote me this: "We did whatever required from our end, still it showing same warning, it may be due to cache, by the way it's not a critical issue, still you can co-ordinate with the plugin developer and ask them what exactly they want us to disable from our server, we'll do that accordingly."

Can you be more specific how can they solve this problem? Thank you!

diosmosis commented 2 months ago

Hi @Tomxcontents, what needs to be done depends on the hosting provider. Can you visit https://yoursite.com/wp-content/plugins/app/vendor/matomo/device-detector/regexes/bots.yml in a browser (replace yoursite.com with your website)? If you see text data in your browser, then the file is still accessible. In this case you can tell your hosting provider that the warning will go away when accessing that URL is not allowed.

Tomxcontents commented 2 months ago

SmartSelect_20240707_120027_Chrome

I get this massage. If its good and cant access any files why the plugin write still warning?

diosmosis commented 2 months ago

This means the hosting provider is returning a 200-300 HTTP response code for the request to that file (which in non-technical terms means, the hosting provider is saying the request was a success, even though the file wasn't found). It should ideally be sending a 404 or 403 code (which means "not found" or "not authorized" respectively). Would you be able to share the URL here or by email? I can check whether this is the case, and if so you can let your hosting provider know. (If by email, email dizzy (at) innocraft (dot) com.)

Tomxcontents commented 2 months ago

Thank you your help!

[redacted for security reasons]

diosmosis commented 2 months ago

Strange, everything looks fine there. Can you provide a copy of your system report: https://matomo.org/faq/wordpress/how-do-i-find-and-copy-the-system-report-in-matomo-for-wordpress/ ?

Tomxcontents commented 2 months ago

Sure.

              # Matomo

Endpoints

Crons

Mandatory checks

Optional checks

Matomo Settings

Logs

WordPress

WordPress Plugins

Server

PHP cli

Database

Browser

diosmosis commented 2 months ago

Thanks @Tomxcontents, I think I see the problem. It seems like your hosting provider blocks access to a file when a user tries to access it through the internet, but not when the server itself tries to access it. Your hosting provider could make a change to do things this way, but it's not really that important.

We'll also change the plugin to avoid this situation, but it may be a while before the change is released. For now, the issue is effectively fixed for you and you can ignore the warning.