This feature works by placing two file,
inside your site's
administrator directory. If
you forget the username/password you used for this feature and you are
locked out of your site, please follow this procedure:
Using your favourite FTP, FTPS or SFTP application, e.g. FileZilla or CyberDuck, log into your site and go into your site's root
Go inside the
DO NOT SKIP THIS STEP or you will be removing the wrong file, causing a big problem on your site (especially if you're using SEF URLs).
Remove both the
.htpasswd files. If you do not see those
files, create two empty text files in your computer, rename them
.htpasswd and upload them.
This is not a bug in Admin Tools, but a problem with one of the extensions (components, modules or plugins) you are using.
There are two workarounds:
Disable the administrator password protection. This degrades your site's security but is the easiest and most immediate change.
Consult the developer of the offending extension and explain to him that loading files from the administrator area of the component in the front-end of the site is insecure and he has to resolve this issue. Hopefully, developers will realize that this practice is unsafe and fix their software.
If after applying the password protection you immediately
receive a blank page or an Internal Server Error 500 instead of a
password prompt, your server is not compatible with the password
protection scheme. In this case, the only way to gain access to your
site's administrator back-end is to remove the
files from your administrator directory using an FTP application or
the File Manager in your site's hosting control panel. If in doubt,
consult your host about how you can do that before trying to apply the
password protection. If those files do not show up in your FTP client,
please create two blank files with those names and upload them to your
site, overwriting the existing (but invisible) ones. This will remove
the password protection so that you can regain entrance to your
Ask your host to disable Apache custom error pages for HTTP status codes 401 and 403.
But why does this happen? (Optional, detailed information; you don't have to read the next paragraphs).
When you enable password protection all you're doing is create a .htaccess file. This tells Apache, your web server, that the administrator directory is password protected. The next time your browser tries to access anything in that directory it has to send an HTTP Basic Authentication header that contains your username and password. If it doesn't Apache returns an HTTP 401 status which, in turn, instructs the browser to ask you for the username and password (and then store it in its authentication cache for the browsing session). This is how your browser knows it needs to ask you for a username and password.
However, HTTP 401 is technically an HTTP error status. Apache has a feature called custom error pages. Depending on the HTTP error status returned (all 4xx and 5xx codes) you can configure Apache to return a static HTML page with custom content to the browser when it sends the error code. This holds true even for the 401 status described above. The real cause of the problem you are facing is that the configured custom error page does not exist. This causes Apache to internally report the file as missing. This breaks the authentication flow and would normally trigger a 404 Not Found error page.
If that wasn't bad enough, Joomla is always configured to catch all missing files and try to figure out if it should try and serve a Joomla page instead. This is required for the correct operation of search engine friendly URLs. So, Joomla sees the missing file error. Not knowing what to do with it, it tries to route it through com_content (the built-in Articles component). Hard as it may try, it can't find an article category which matches the URL. This causes Joomla to throw an error. This is what ends up being displayed as the 404 or Joomla error page you are receiving.
When you disable custom error pages for the 401 error code you let Apache communicate that status directly to the browser without Joomla interfering. This lets the password protection work properly. FYI, the aforementioned error will also take place if you use your hosting control panel's directory password protection feature. It is not caused by Admin Tools. It is caused entirely by your server's configuration. Also note that most hosts do let you define and reset custom error pages through the hosting control panel.