plesk-stat/webstat/ was publicly accessible by default?

mrcheez

I'm assuming this isn't standard, but my managed-hosted website is with a well established Irish company (I won't name them just in case) and I haven't had cause to check the plesk-stat/webstat/ for a while until a recent surge in bot activity.

I noted that the plesk-stat/webstat/ folder didn't require a login, and I tested on a couple of other browsers to be certain.

So yes all the stats regarding visitors to my site has been publicly available for ages and I was none the wiser.

Surely this should have been locked down when plesk was getting setup?