It shouldn't be publicly accessible by default as it could lead to potential DoS attack.

Docs mention it:
Web Cron When Your Web Host Does Not Support Cron Tasks

Ok, I see CronArchive checks token_auth. But the code says archive.* scripts are deprecated or not recommended. Maybe this use case should no longer be documented?

I don't know, I'm just an user. So there is another front controller for web cron?

By the way, one travis job failed, but it doesn't seem to be related to this issue.

the archive.php is still used for webcron (the warning is not shown in the webcron).
is there a reason for the updatetoken.php added there as well?

@mattab Only reason is that the updatetoken.php code it looks to me like another front controller. I can exclude it from the directive if I'm wrong.

yes please exclude it as it is not needed to access this file from HTTP

@mattab Done. Not sure what's happening with tests though.

The failures are un-related to your change, I tried to fix one here: 5e3a47a
and contacted Travis CI about the other! cheers

Yeah, as for [https://travis-ci.org/piwik/piwik/jobs/23912449] it seems that test failed one because of 2 microseconds difference in assertion, the other one might be travis issue

Not sure if it helps, but recently Travis switched PHPUnit installation from PEAR to PHAR: travis-ci/travis-ci#2223