just found these ideas regarding optimisation of security of piwik.
Since these are very specific and not only general ones, we should be glad to got them for free and should really think about each single one:

• do they fit to latest piwik version?
• is there a good reasons why it's no good idea to follow them?
• do we have better ideas?
• open a new ticket for each accepted one.

here they are:
...............................................
...My suggestions to you are as follows:

1. It seems some Piwik installations used to be ok some time ago but for some reasons (maybe changes/updates on a server) seem to get broken. In such situations, I would suggest to not reveal server information on the Piwik Admin website.

2. In general, I would rather suggest storing such information in log-files instead of displaying them so that they can only be accessed with appropriate privileges.

3. I would suggest to split/separate the API URL from the Admisistration and Statistics URL. That would also support the use of .htaccess protection to the Admin and/or Statistics part of Piwik.

4. I would definitely recommend to add the noindex, nofollow metatags as mentioned in your blog but I would also suggest to place an initial robots.txt file on the webserver root if it doesn’t exist or add lines to it if it exists. Both at least hides Piwik from search engines (even though not all engines regard those but Google does and was the main source of my findings)

5. If one or all of the above would be too difficult or not yet possible, at least place some big warnings in your setup documentation or setup UI (like you already do for other purposes)
   ...............................................
   source http://networktoolbox.de/again-about-piwik/