New One-click installs: WordPress, WooCommerce, Mage-OS and PrestaShop on any server

See the plans
Security and protection1 min readUpdated

Protect the Magento admin

An IP allow-list and an extra password in front of the admin, set at the web server, plus the basics in Magento itself.

The admin is where a store is most often attacked. A second lock in front of it, at the web server, stops attacks before Magento even sees them.

ProtectionHow
IP allow-listOnly your addresses can open the admin path. Others are refused at nginx.
Basic authenticationAn extra user and password before Magento's login page.
Two-factor in MagentoKeep Magento's own 2FA module enabled.
Custom admin pathA non-obvious admin path; set in Magento (the protection follows the path you give).

Ask us in a ticket to turn on the IP allow-list or basic authentication for your store's admin; tell us the addresses or the user name you want.

Locked out of the admin after too many wrong passwords? Use Actions, Unlock an admin user.

Did this solve it? If not, tell us what you see and we look at your server.

Open a ticket

Keep reading

All 13 guides
How Gen2 servers are securedThe layers that protect every server: updates, SELinux, firewall, SSH, fail2ban, per-application isolation, bot protection and backups.1 min readBot and overload protection explainedHow the Protection tab keeps bots and botnets from overloading your store, with the settings and what each one does.2 min readThe browser check: what visitors see and when it switches onA short page that stops bots and lets people through. When it runs on its own and how to turn it on or off.1 min read

Still stuck? Ask a person.

Tickets go straight to the engineers who run ShopWhizzy servers. Tell us the store, what you see and when it started, and we take it from there.

Open a ticket Help center