I want to add 2 step Authentication to an admin back end URL to my clients online Magento shop. I don't want to use a google app authentication or a phone app/sms system. I want a master Username/Password for the first step then my usual admin accounts.

I've been googling for a while but can't find anything except for SMS/App authentication, is there some other way I'm missing?


2 Answers 2


It seems you want to add a .htaccess directory protection.

Ad there is no real admin folder, you need to work around this:

SetEnvIfNoCase Request_URI "^/admin/" ADMIN

AuthType Basic
AuthName "Magento Admin"
AuthUserFile /path/to/.htpasswd
Require valid-user

Satisfy any
Order allow,deny
Allow from all
Deny from env=ADMIN

Just add the usernames + passwords in the .htpasswd file and your're good to go.

You may also want to think of a solution like this where only certain IPs are allowed to access your admin URL:

RewriteCond %{REQUEST_URI} ^/admin/(.*)$
RewriteCond %{REMOTE_ADDR} !^$ #your IP
RewriteRule ^(.*)$ - [F,L]
  • Thankyou Anna, just what I was after! IP and .htpasswd both worked perfectly!
    – SixShields
    Commented Feb 25, 2016 at 0:08

it's an old topic but I was looking for something like that and found it

first, thanks Anna for your answer, it helped me

but I see 2 problems:

  1. leading ^ => /admin/ will be protected but /index.php/admin/admin/ won't be
  2. trailing / => /admin/ will be protected but /admin won't be

so I use "/admin" instead (except I don't use "admin", see below)

so yes, frontend URL containing "/admin" will be caught but remember that we are talking of the "admin" token only if you chose to let "admin" as identifier to your admin panel

you should change this identifier and put something harder to find and that you won't get in frontend

and code for Apache 2.4:

SetEnvIfNoCase Request_URI "/[your admin identifier here]" ADMIN
AuthType basic
AuthName "Restricted Access"
AuthUserFile [path to your .htpasswd here]
        Require env ADMIN
        Require valid-user
        Require not env ADMIN
        Require all granted
  • .htaccess login popup is coming but if i click on Cancel button then still it is logging successfully. what should i do ? Commented Aug 20, 2019 at 8:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.