I'm trying to determine how to remove index.php from the Admin page URLs.

I already know how to do it for SEO on public facing pages as is documented here. And "Use Web Server Rewrites" is already on, it just isn't working for admin URLs.

Perhaps it doesn't matter that much that it includes index.php, but cleaner URLs would be much easier to manage patterns for .htaccess rules and my WAF (Web Application Firewall).

Update: I uncommented the following two lines from the .htaccess, this is not a solution. I expect there must be a setting somewhere in Magento that tells it to generate links that exclude the index.php.

## externally rewrite index.php/admin to admin
    RewriteCond %{REQUEST_URI} ^/index.php/admin.*$
    RewriteRule ^index.php/admin(.*) /admin$1 [R]
  • why would you want to remove index.php from the admin pages? What business value do you gain by doing this?
    – Marius
    Commented May 29, 2015 at 7:57
  • 1
    And while you're at it, you can remove that big, ugly URL form-key... Umm, ahem... Commented Aug 3, 2015 at 17:50

1 Answer 1


No, there is no setting for it. index.php is only removed from the URL on the frontend, on purpose.

The responsible code is in Mage_Core_Model_Store:

 * Remove script file name from url in case when server rewrites are enabled
 * @param   string $url
 * @return  string
protected function _updatePathUseRewrites($url)
    if ($this->isAdmin() || !$this->getConfig(self::XML_PATH_USE_REWRITES) || !Mage::isInstalled()) {
        $indexFileName = $this->_isCustomEntryPoint() ? 'index.php' : basename($_SERVER['SCRIPT_FILENAME']);
        $url .= $indexFileName . '/';
    return $url;

The doc comment is misleading, actually index.php is added to the base URL in any of these cases:

  1. Current area is admin panel
  2. "Use Rewrites" is configured as "No"
  3. Current area is installation wizard

I assume, this has been done to make sure you always can access the admin area, even if rewrites are not working, to turn of the "Use Rewrites" configuration.

You could override this method and remove isAdmin() ||, it will work as long as webserver rewrites are working.

But if your actual problem is, to make it

much easier to manage patterns for .htaccess rules and my WAF (Web Application Firewall).

I don't see how it's worth the effort. It is just as easy to disallow ^(index\.php)?/admin as to disallow ^admin. Also it won't help you to disallow only one of the variants because you always can access any page with or without index.php, no matter how the links are generated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.