The CMS panel on the host: Bitrix, WordPress and an address everyone knows
The admin panel lives at a well-known path. Hiding the address helps a little. The password, a second factor and separate roles help for real.
WordPress, Bitrix, OpenCart and custom panels open at addresses that are not a secret. People rename them and consider the question closed. Guessing and someone else's password from an old database arrive at the new path a bit later, sometimes immediately, if the link stayed in a contractor's bookmark. Changing the address is hygiene. It is not protection.
What matters more than a pretty path
- Separate people, not one admin for the owner, the studio and the content manager.
- A second factor for those who can install modules and edit files.
- Updates of the CMS itself and of the modules. The host often does not update those.
- The panel is not on the homepage for the whole internet if the business does not need that. A limit by office address or VPN is simpler than a secret URL.
Old copies of the panel in a neighboring folder walk around any renamed door on the new storefront. So the whole host has to be looked at, not only the address printed in the manual. The sign-in log, if it exists, should be opened not after the news, but when a person with access has left.
Lexora checks panels in a site audit: the path, who is an admin, which version, whether there is a second copy. For new clients this is free. If an account area with orders sits behind the panel, the next step we name is a pentest, from $50 per endpoint, not another article about a "secret admin address". On maintenance, updates and roles stay in the work, so the manual does not go stale a month after the report.
Related Lexora services
Does the admin panel open at a well-known address?
We will look at the roles and a second copy on the host. Renaming the path changes little by itself.