Fix this week

Your admin login page is open to the public internet

This is the exact wording EverThread uses when it finds this on a customer's site, written for someone who runs a business, not a server. The example site here is yourbakery.com.

What we saw

https://yourbakery.com/admin answers to anyone who visits it.

Why it matters

Admin logins are where automated password-guessing attacks go first. Hiding or limiting the page removes most of that traffic.

How to fix it

Ask your developer to limit the admin page to known addresses, add a second login factor, or put it behind a VPN or access rule.

For your developer