This is indeed a bug in Admin Tools 7.8.9. The destroyCookie() method in the Admin Secret Word feature had a variable ($isHttpsForced) that was only initialised inside the Joomla 6.x code branch, but was also used in the Joomla 5.x branch below it. On any Joomla 5.x site the variable would be undefined, triggering the PHP warning — and since the warning was output before the cookie header could be sent, that in turn caused the cascading “headers already sent” warning.
We have fixed this and uploaded a developer’s release for you to test:
https://www.akeeba.com/download/developer-releases.html
Please scroll down to the Admin Tools for Joomla! section. The latest dev release at the top of that section contains the fix. Install it over your existing version and let us know if the warnings are gone.
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!