Private Directories under Plesk

Support & Bugs
1

Hey there matomo fam,

I’m running matomo with the following config:
Matomo 4.15.0, PHP 8.0.29, Apache2 on Plesk hosted by IONOS.

While tracking is working diagnostics showing me the following error:
Required Private Directories
https:// condescending-newton.212-227-211-201.plesk.page/matomo/config/config.ini.php
https:// condescending-newton.212-227-211-201.plesk.page/matomo/tmp/
https:// condescending-newton.212-227-211-201.plesk.page/matomo/tmp/empty
https:// condescending-newton.212-227-211-201.plesk.page/matomo/lang/en.json
(This is a test server)

I checked the .htaccess files and when I copy one to the main path the whole access is blocked, so for me seams to work correctly but I am not sure about that.

Here is the full sys report

<details>
<summary>Click to view System Check</summary>

### Mandatory checks

#### PHP version >= 7.2.5:
 ✔ 8.0.29

#### PDO extension:
 ✔ 

#### PDO\MYSQL extension:
 ✔ 

#### MYSQLI extension:
 ✔ 

#### Other required extensions:
 ✔ zlib ✔ json ✔ filter ✔ hash ✔ session

#### Required functions:
 ✔ debug_backtrace ✔ eval ✔ hash ✔ gzcompress ✔ gzuncompress ✔ pack

#### Required PHP configuration (php.ini):
 ✔ session.auto_start = 0 ✔ max_execution_time = 0 OR = -1 OR >= 30

#### Directories with write access:
 ✔ $DOC_ROOT/tmp ✔ $DOC_ROOT/tmp/assets ✔ $DOC_ROOT/tmp/cache ✔ $DOC_ROOT/tmp/climulti ✔ $DOC_ROOT/tmp/latest ✔ $DOC_ROOT/tmp/logs ✔ $DOC_ROOT/tmp/sessions ✔ $DOC_ROOT/tmp/tcpdf ✔ $DOC_ROOT/tmp/templates_c


### Optional checks

#### Required Private Directories:
⚠ Error: $MATOMO_URLconfig/config.ini.php
We found that the above URLs are accessible via the browser, but they should NOT be. Allowing them to be accessed can pose a potential security risk since the contents can provide information about your server and potentially your users. Please restrict access to them.<br/><br/>We also found that Matomo's config directory is publicly accessible. While attackers can't read the config now, if your webserver stops executing PHP files for some reason, your MySQL credentials and other information will be available to anyone. Please check your webserver config and deny access to this directory.<br/><br/>Read this to learn more.
#### Recommended Private Directories:
⚠ Error: $MATOMO_URLtmp/⚠ Error: $MATOMO_URLtmp/empty⚠ Error: $MATOMO_URLlang/en.json We found that the above URLs are accessible via the browser, but we recommend they should not be. If possible, please restrict access to them. Read this to learn more.

#### File integrity:
 ✔ 

#### 64-bit PHP Binary:
 ✔ 

#### Tracker status:
 ✔ 

#### Memory limit:
 ✔ 128M

#### Time zone:
 ✔ 

#### Open URL:
 ✔ curl

#### PageSpeed is turned off:
 ✔ 

#### GD > 2.x + FreeType (graphics):
 ✔ 

#### Other extensions:
 ✔ json ✔ libxml ✔ dom ✔ SimpleXML ✔ openssl

#### Other functions:
 ✔ shell_exec ✔ set_time_limit ✔ mail ✔ parse_ini_file ✔ glob ✔ gzopen ✔ md5_file

#### Filesystem:
 ✔ 

#### Set up Cron (faster report-loading):
 ⚠ Warning: For optimal performance and a speedy Matomo, it is highly recommended to set up a crontab to automatically archive your reports, and to disable browser triggering in the Matomo settings. Learn more.

#### Set up Cron - Managing processes via CLI:
 not supported (optional) (Reasons: Unknown) learn more

#### Database abilities:
 ✔ UTF8mb4 charset ⚠ Warning: LOAD DATA INFILE<br/>Hint: Using LOAD DATA INFILE by updating your PHP and MySQL software and ensuring your database user has the FILE privilege speeds up Matomo's archiving process a lot.<br/>You should fix this problem if your Matomo server tracks high-traffic websites (e.g. over 100,000 pages per month).<br/><strong>Error:</strong> LOAD DATA INFILE failed... Error was: <br/>  Try #1: LOAD DATA INFILE : SQLSTATE[28000]: Invalid authorization specification: 1045 Access denied for user 'matomo'@'%' (using password: YES)[28000],<br/>  Try #2: LOAD DATA LOCAL INFILE : SQLSTATE[HY000]: General error: 4166 The used command is not allowed because the MariaDB server or client has disabled the local infile capability<br/>Troubleshooting: FAQ on matomo.org ✔ CREATE TEMPORARY TABLES ✔ Changing transaction isolation level

#### Max Packet Size:
 ⚠ Warning: It is recommended to configure a 'max_allowed_packet' size in your MySQL database of at least 64MB. Configured is currently 16MB.

#### Forced SSL Connection:
 ⚠ Warning: We recommend using Matomo over secure SSL connections only. To prevent insecure access over http, add <code>force_ssl = 1</code> to the <code>General</code> section in your Matomo config/config.ini.php file.

#### Geolocation:
 ⚠ Warning: The default location provider determines the country visitors connect from based on their selected language. This is not very accurate, so install and use a geolocation database.

#### Update over HTTPS:
 ✔ 

#### Writable JavaScript Tracker ("/matomo.js"):
 ✔ 


### Informational results

#### Matomo Version:
 4.15.0

#### Matomo Update History:
 4.15.0,

#### Matomo Install Version:
 4.15.0

#### Latest Available Version:
 4.15.0

#### Is Git Deployment:
 0

#### PHP_OS:
 Linux

#### PHP_BINARY:
 /opt/plesk/php/8.0/bin/php-cgi

#### PHP SAPI:
 cgi-fcgi

#### Timezone Version:
 0.system

#### PHP Timezone:
 UTC

#### PHP Time:
 1689061013

#### PHP Datetime:
 2023-07-11 07:36:53

#### PHP Disabled functions:
 opcache_get_status

#### PHP INI max_execution_time:
 30

#### PHP INI post_max_size:
 8M

#### PHP INI max_input_vars:
 1000

#### PHP INI zlib.output_compression:
 

#### Curl Version:
 7.74.0, OpenSSL/1.1.1n

#### Suhosin Installed:
 0

#### DB Prefix:
 matomo_

#### DB Charset:
 utf8mb4

#### DB Adapter:
 PDO\MYSQL

#### MySQL Version:
 10.5.19-MariaDB-0+deb11u2

#### Num Tables:
 31

#### Browser Segment Archiving Enabled:
 1

#### Development Mode Enabled:
 0

#### Internet Enabled:
 1

#### Multi Server Environment:
 0

#### Auto Update Enabled:
 1

#### Custom User Path:
 0

#### Custom Include Path:
 0

#### Release Channel:
 latest_stable

#### Plugins Activated:
 API, Actions, Annotations, BulkTracking, Contents, CoreAdminHome, CoreConsole, CoreHome, CorePluginsAdmin, CoreUpdater, CoreVisualizations, CoreVue, CustomDimensions, CustomJsTracker, Dashboard, DevicePlugins, DevicesDetection, Diagnostics, Ecommerce, Events, Feedback, GeoIp2, Goals, Heartbeat, ImageGraph, Insights, Installation, Intl, IntranetMeasurable, LanguagesManager, Live, Login, Marketplace, MobileMessaging, Monolog, Morpheus, MultiSites, Overlay, PagePerformance, PrivacyManager, ProfessionalServices, Proxy, Referrers, Resolution, RssWidget, SEO, ScheduledReports, SegmentEditor, SitesManager, Tour, Transitions, TwoFactorAuth, UserCountry, UserCountryMap, UserId, UserLanguage, UsersManager, VisitFrequency, VisitTime, VisitorInterest, VisitsSummary, WebsiteMeasurable, Widgetize

#### Plugins Deactivated:
 DBStats, MobileAppMeasurable, TagManager

#### Plugins Invalid:
 

#### Server Info:
 Apache

#### Had visits in last 1 day:
 0

#### Had visits in last 3 days:
 0

#### Had visits in last 5 days:
 0

#### Archive Time Last Started:
 -

#### Archive Time Last Finished:
 -

#### User Agent:
 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36

#### Browser Language:
 de-de,de,en-us,en

#### Total Invalidation Count:
 0

#### In Progress Invalidation Count:
 0

#### Scheduled Invalidation Count:
 0

#### Earliest invalidation ts_started:
 

#### Latest invalidation ts_started:
 

#### Earliest invalidation ts_invalidated:
 

#### Latest invalidation ts_invalidated:
 

#### Number of segment invalidations:
 0

#### Number of plugin invalidations:
 0

#### List of plugins being invalidated:
 

#### Anonymize Referrer:
 

#### Do Not Track enabled:
 1

</details>