XF 2.2 How do I hide admin.php

[D500hz]

Hi can anyone help how do I hide for example: mydomain.com/admin.php? or make a security to it thank you

 

[TPerry]

You can't "hide" it... but you can protect it.

Protecting admin.php, the /install directory, and test & development installations using .htaccess

If you want to provide an extra layer of protection to admin.php, the /install directory, and test & development installations, you can do so with .htaccess authentication. Protecting admin.php To protect admin.php, edit the .htaccess file...

xenforo.com

If you are using nginx for your http server, it will require a different process.

 

[digitalpoint]

If you use Cloudflare, you can protect it upstream of your server before the HTTP requests even get to your server with their Zero Trust Network Access. It’s free if you have less than 50 people that need access (50 admins).

Access | Zero Trust Network Access

Secure your employee access with a faster and safer VPN alternative. Free for up to 50 users. See why IDC named us a Leader.

www.cloudflare.com

 

[James]

I think you could rename admin.php too if you so required - or at least you used to be able to.

All rather redundant if you're using htpasswd or 2FA. Like putting a plaster on a knife wound.

 

[Wildcat Media]

If you use Cloudflare, you can protect it upstream of your server before the HTTP requests even get to your server with their Zero Trust Network Access. It’s free if you have less than 50 people that need access (50 admins).

I've done this. It works like a gateway where someone attempting to log in is stopped at the Cloudflare border with 2FA and isn't even touching my forums. Once past that, there is also the additional XF login to get to the admin panel.

 

[Paul B]

I think you could rename admin.php too if you so required - or at least you used to be able to.

That requires renaming the php file, editing a few templates, and an addition to the config.php file:

$c['router.admin.formatter'] = $c->wrap(function($route, $queryString)
{
   $suffix = $route . (strlen($queryString) ? '&' . $queryString : '');
   return strlen($suffix) ? 'new_admin.php?' . $suffix : 'new_admin.php';
});

All rather redundant if you're using htpasswd or 2FA. Like putting a plaster on a knife wound.

Quite.

 

[MentaL]

Could use htaccess and restrict to IP access.

 

[D500hz]

You can't "hide" it... but you can protect it.

Protecting admin.php, the /install directory, and test & development installations using .htaccess

If you want to provide an extra layer of protection to admin.php, the /install directory, and test & development installations, you can do so with .htaccess authentication. Protecting admin.php To protect admin.php, edit the .htaccess file...

xenforo.com

If you are using nginx for your http server, it will require a different process.

Thank you so much for the tutorials, it's now functioning!

 

[D500hz]

If you use Cloudflare, you can protect it upstream of your server before the HTTP requests even get to your server with their Zero Trust Network Access. It’s free if you have less than 50 people that need access (50 admins).

Very helpful, thank you. Later on, I'll get to this.