It depends on how much effort you are willing to spend on protecting the admin area.

• One simple but effective approach is to use a cryptographic URL to access the admin area. Something like a hash (e.g. "u59sOgpDJa~M" instead of simply "admin") or similar that changes on regular basis. This way an attacker can't go for it directly because he doesn't know the address and should search for it first.

• Second you must limit number of failed login attempts. It's very important so a brute force attack can't be performed easily. For example lock down the IP address for a few hours after a couple of failed logins. Moreover you can make a delay between each login attempt response, like a few seconds that users doesn't notice but slows down robots significantly.

It depends on how much effort you are willing to spend on protecting the admin area.

• One simple but effective approach is to use a cryptographic URL to access the admin area. Something like a hash (e.g. "u59sOgpDJa~M" instead of simply "admin") or similar that changes on regular basis. This way an attacker can't go for it directly because he doesn't know the address and should search for it first.

• In addition you must limit number of failed login attempts. It's very important so a brute force attack can't be performed easily. For example lock down the IP address for a few hours after a couple of failed logins. You can use Fail2ban, DenyHosts, OSSEC, etc. or you can implement your own. Moreover you can add a delay between each login attempt response, like a few seconds that users doesn't notice but slows down robots significantly.

It depends on how much effort you are willing to spend on protecting the admin area.

One simple but effective approach is to use a cryptographic URL to access the admin area. Something like a hash (e.g. "u59sOgpDJa~M" instead of simply "admin") or similar that changes on regular basis. This way an attacker can't go for it directly because he doesn't know the address and should search for it first.

It depends on how much effort you are willing to spend on protecting the admin area.

• One simple but effective approach is to use a cryptographic URL to access the admin area. Something like a hash (e.g. "u59sOgpDJa~M" instead of simply "admin") or similar that changes on regular basis. This way an attacker can't go for it directly because he doesn't know the address and should search for it first.

• Second you must limit number of failed login attempts. It's very important so a brute force attack can't be performed easily. For example lock down the IP address for a few hours after a couple of failed logins. Moreover you can make a delay between each login attempt response, like a few seconds that users doesn't notice but slows down robots significantly.