If you are Logged in, using user name and password and browsing internal pages , then try changing directly. If you are checking some publisher site statistics with publisher site ID =123 . Try directly changing parameter to different site ID which is not related to the logged in user , Access should be denied for the other stats