1. Is it secure to use a familiar URL such as website/admin or should I use a different name so it would be harder to find the page in the first place (assuming no traffic monitoring)?

  2. I'm using SSL. Do I need to further encrypt the admin password using RSA per sy? Two factor authentication too? Is it overkill?

  3. Should I use something like a VPN to have a fixed IP and limit the login page to that IP? (What will I do if I no longer have that VPN?)

  4. Any other tips, pitfalls, security risks that I need to look out for (apart from brute forcing)?


I can't help but feel this is a bit too broad as your asking 3 rather open ended questions but I'll attempt to answer each in turn:

  1. Using a common URL for an admin area shouldn't be a problem - yes common "hacking" scripts will attempt common exploits against the common ones but that shouldn't mislead you into thinking you should hide the address or that you have any real appreciable gain in security from doing so. This is a case where Kerckhoffs's principle applies - you must assume a starting point that the attacker knows where the admin URL is.

  2. Encrypting (or more specifically cryptographically hashing) the password using something like bcrypt should be a standard step, as you point out ssl will protect the password in-transit between client and server but hashing the password protects it at rest. Using SSL in the login process does nothing to protect you from the attacker who compromises the database and gets all your plaintext passwords.

  3. Can't really answer this without knowing the use-case for the system. If it's only ever required to connect from one connection then VPN with a fixed IP can add an extra layer, with the risk that you point out that if you lose access to that connection and have no other way to access the system enough to change that IP restriction then you're kind of screwed. There are plenty of ways to put failsafes in for this sort of scenario but without much more detailed information on the specifics of the system and it its intended purpose it's far too broad a topic to address here.

  • I disagree with your first point. A well hidden admin page can stop most skids from further exploiting the website.
    – t.m.adam
    May 30 '17 at 1:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.