2

We use nginx and in an effort to stop all thos IP's trying to find our secret admin url we wanted to add a nginx location rule:

Looking in location Where the first directory/folder contains the word admin (or others) followed by anything after that but not excluding /xxxx/adminhtml/ where the word admin is found in the second folder or route

Our code so far

Drop people trying to access admin
location ~* /.*admin.*\/.*/ {
  return 444;
}

or maybe

location ~* /.*admin[^\/]*\/.*/ {
  return 444;
}
  • hm, it's better to protect secret admin path. no point to protect what is not exists... if you really need to block something, use fail2ban or csf firewall and scan logs for pattern. – MagenX Jan 7 '16 at 12:50
  • Yes i agree. Just wanted to stop scanning - other two I am less familiar with – snh_nl Jan 8 '16 at 17:31
3

The easiest is sometimes the most effective

location ~ ^/admin/. {
   return 444;
}

Why only directly admin? To big chance of false positives, like images or products containing things like MadMinifierShirt (are urls case sensitive?)

My suggestions is, you block only a hand full of simple routes, and dont try to create a fancy regex here.

as some mentioned custom admin paths:
still it can help to avoid people trying to search for the secret name. Also for managed hosting its better to use a default instead of a secret admin path, as its easier to create firewall rules to protect the shops of customers.

  • there is no logic in this. if it not exist why you need to block it??? i do understand when you need to block some sensitive files, but they must exist... – MagenX Jan 19 '16 at 11:33
  • thats the concept of the low hanging fruit. You sure dont block all, but there will be some who will not search for a custom path, when the most common one is blocked. – Flyingmana Jan 19 '16 at 18:36
  • yes, probably, but this one will not work, because there is /index.php/ in front of all queries to admin location... it is better to protect exsiting admin path... – MagenX Jan 20 '16 at 8:24
  • If it would not be a sufficient solution, people who do know better then me would post a corrected version and the problem solves itself via the voting system. – Flyingmana Jan 20 '16 at 19:33
  • as you know many users just copy-paste, they only care when their hacked... – MagenX Jan 20 '16 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.