I have a custom admin url, still I saw someone trying to login into admin.

I even changed it, and shortly after the next login was tried.

How could this happen, I thought its secure?

  • This is security through obscurity which is not a good practice. It doesn't matter if people try to login to your admin URL as long as they aren't successful.
    – Jon
    Commented May 7, 2015 at 1:15
  • No matter how cleverly generic the custom Admin URL, it's probably been used before. A library of admin type URLs is readily available to scan a website. Try another tack. You don't need to be sitting in your local Starbucks working on your website backend. Use .htaccess to limit by IP address the access to /admin and /downloader. Commented May 7, 2015 at 3:48
  • See also magehero.com/posts/886/…
    – Willem
    Commented May 7, 2015 at 5:49
  • 2
    the funniest is that many users put this custom path to their robots.txt, as Disallow... and all the other links/files i always get from robots.txt, why they do this is beyond my imagination...
    – user2857
    Commented May 7, 2015 at 8:40
  • Another way. Ouch, what was the point? => magento.stackexchange.com/questions/68003/… Commented May 17, 2015 at 0:43

3 Answers 3


There are a handful of ways your admin url can be exposed. Some include

  • Modules that incorrectly create admin controllers. Visiting a known, improper, admin frontname will redirect to the login screen. For instance, hitting example.com/mymodule_admin/foo/bar. A "safe" admin controller will extend on top of your customadmin frontname, like example.com/customadmin/mymodule/foo_bar.
    • There is a fix for this with SUPEE-6788, but it's a setting you have to change manually.
  • The URL is visible in the XML response of example.com/index.php/rss/order/NEW/new.
    • Fixed with SUPEE-6285
  • Some web hosts create access logs in public areas, like example.com/access_logs. An attacker could look through these logs and sniff out promising URLs.
  • Visiting an improperly secured admin controller (e.g. example.com/downloadable/Adminhtml_Downloadable_File/upload)
    • Fixed with SUPEE-5994
  • You probably haven't noticed the downloader url (example.com/downloader). Though it's safe behind a login screen, if brute forced an attacker can navigate back to your admin url.

Security through obscurity isn't secure at all. To be safe you should protect your admin interface. This can be done with IP filtering, captchas, rate limits, etc. And, of course, use strong passwords. After all, seeing your admin login screen isn't actually a problem. It's only a problem is an unauthorized user gets in.

  • 4
    Also worth mentioning: Use Magento Guest Audit to scan your site. You'd be surprised at how much you reveal to visitors. (web interface is new, needs work) Commented May 7, 2015 at 5:52
  • 1
    Bullet point one is addressed finally by SUPEE-6788. Install it, upgrade any modules that won't work with it, disable Admin Routing Compatibility Mode. This => github.com/rhoerr/supee-6788-toolbox tells you which modules are likely to allow the bypass. Commented Nov 16, 2015 at 19:34

The reality is, security by obfuscation nearly never works. I assume it does not even protect you from script kiddies.

But to this case. There are admin modules using their own routes for the admin urls, not using your custom admin url. Payment modules are likely to do this for example(I found 4 of them at our shop).

You can finde some on github with https://github.com/search?p=1&q=AdminController+%22extends+Mage_Adminhtml_Controller_Action%22&ref=searchresults&type=Code&utf8=%E2%9C%93
I assume every controller class not containing _Adminhtml_ is usable for this.

side note, custom url for admin, but not for /downloader ? just brutforce an admin user there, and you get the admin url from there.

  • Really interesting. Thanks for the share. Which payment modules are you using out of interest?
    – Shaughn
    Commented May 6, 2015 at 22:16
  • 2
    This is also currently possible on a vanilla Magento installation. Just hit a certain url and it takes you to the admin route (custom or not). Commented May 6, 2015 at 23:28
  • @JamesAnelay Care to share with the rest of the class? Commented May 7, 2015 at 5:18
  • @JamesAnelay Magento are currently working on this. They would probably appreciate not spreading the information. Commented May 7, 2015 at 8:49
  • 1
    It's better to use a Web Application Firewall or .htaccess lockdown rules against admin, connect and downloader functions than to cross your fingers and obscure. Passive methods like SBO (Security by Obscurity) have no teeth, they take care of no security issue, just move its access in the hopes you get lucky. It's what I call the picket fence method of security, there are gaps between the slats and the attacks are always able to fit through the gaps. Commented Sep 5, 2015 at 20:38

A very nice one is when it appears on similarweb.com because you use a chatty browser-plugin ... (http://www.howtogeek.com/180175/warning-your-browser-extensions-are-spying-on-you/)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.