Fix this week

Your admin login page is open to the public internet

What it means

Most websites have a private area where you edit pages, manage orders or change settings. We found its login page answering at yoursite.com/admin: a separate page, not your home page, that asks for a username or password.

Anyone who types that address sees the login form. Nothing has been broken into. It simply means the front door to your site's controls is visible to the whole internet, not only to you and your staff.

Why it matters

Automated tools try common admin addresses on huge numbers of sites and then guess passwords, or try ones leaked from other breaches. They do not care how small your business is.

If one guess works, the person gets full control: they can change your pages, add spam or card-stealing code, create their own admin account, or lock you out.

Two-step login stops most of these attacks even if a password is guessed. Limiting who can reach the page stops them before they start, and it cuts down the junk traffic hitting your server.

How to check your own site

1. In a private browser window, go to https://yoursite.com/admin on your own site. If a login form appears, this finding applies to you.
2. Make a list of every account that can log in there. Remove people who no longer need access, such as former staff or old agencies.
3. For each remaining account, check whether two-step login (also called two-factor or 2FA) is turned on.

How to fix it

Any website

1. Give every admin account a long, unique password that is not used anywhere else. A password manager makes this easy.
2. Turn on two-step login for every admin account, so a password alone is not enough to get in. Where to find it depends on your platform. Look in the admin's security or user settings, or ask your developer.
3. Ask your developer whether the site limits failed login attempts. After a handful of wrong guesses, it should slow down or block that visitor.
4. If only a few people log in, from a few places, ask your developer or host to allow the admin page only from those internet addresses, or to put it behind a separate access check. The sections below show how.

WordPress

1. WordPress logins live at /wp-login.php and /wp-admin. The address /admin usually forwards there, so the steps apply to those pages.
2. Under Users, remove accounts that no longer need access, and make sure only the people who truly need it have the Administrator role.
3. Install a well-reviewed two-factor plugin from wordpress.org/plugins and turn it on for every administrator. Some security plugins also add a limit on login attempts.
4. Many hosts can restrict wp-login.php to your own internet address for you. Ask support. Renaming the login address with a plugin cuts down junk traffic, but it is not a replacement for two-step login.

Shopify, Squarespace, Wix and other hosted builders

1. The real admin for these platforms is run and protected by the platform itself. You cannot restrict it by address, but you can turn on two-step login in your account security settings, and you should.
2. Check the staff or contributor list and remove anyone who no longer needs access.
3. If yoursite.com/admin on your domain shows a login page that is not the platform's own, find out what it is. It may be an app, an embedded tool, or a page someone added.

cPanel hosting

1. If your admin area is a real folder, cPanel's "Directory Privacy" tool (called "Password Protect Directories" on older versions) can add a second username and password in front of it.
2. To allow only certain internet addresses, add a rule to the .htaccess file inside the admin folder, as shown under "Apache or Nginx" below.
3. Test in a private window afterward, and make sure you still have a way in from wherever you work.

Cloudflare

1. If your site runs through Cloudflare, you can block the admin page for everyone except your own addresses. Go to Security, then WAF, then Custom rules (names vary slightly between plans).
2. Create a rule that matches when the URI Path starts with /admin and the IP source address is not in your list, with the action Block.
3. If your staff work from changing locations, Cloudflare's Zero Trust Access can ask for an email code or a company login before the admin page loads, instead of relying on fixed addresses.

Apache or Nginx

1. Replace 203.0.113.10 with the internet addresses that should have access. You can find your current one by searching "what is my IP" from the office network.
2. On Apache, put the rule in a .htaccess file inside the admin folder, or in a <Location "/admin"> block in the site configuration.
3. On Nginx, add the allow and deny lines to the location that serves the admin area, keeping the lines that already pass requests to your app. Test with nginx -t and reload.
4. Office and home addresses can change. If they do, you will be locked out until the rule is updated, so keep a note of how to change it.

# Apache 2.4 (.htaccess in the admin folder)
Require ip 203.0.113.10

# Nginx (inside the server block)
location /admin {
  allow 203.0.113.10;
  deny all;
  # keep your existing proxy_pass or fastcgi lines here
}

What to send your developer

/admin returns a distinct page with a login form to anyone. Enforce MFA for all admin accounts, rate-limit or lock out repeated failed logins, and restrict the admin path by source IP or put it behind an identity-aware access proxy. If an IP rule is enforced at a CDN, make sure the origin only accepts traffic from the CDN, or the rule can be bypassed. Remove stale admin accounts and review login logs for repeated failures.

(starts_with(http.request.uri.path, "/admin") and not ip.src in {203.0.113.10})

Common questions