We are about a month away from launching a pretty important site, which comes with an admin console to help us manage the site.
Now I'm not very interested at just leaving the admin out in the open for anyone to "have a crack at" - how do large sites like ebay, facebook etc handle this kind of stuff? I'm sure they have some form of admin console for them to manage various things throughout the site, but I'm sure it's locked down in some fashion.
How does one protect an admin so only specific people can access it? I'm not talking about password protection (obviously it's already password protected), but I'm talking about actually protecting the login page so no-one else can actually have access to the page.
I think I read something awhile back about possibly using a SSL cert to only allow certain IP's? Little hard with that since most people have dynamic IP's. :(