How to swap/move the admin folder from the root directory for security reasons

Hi.
We use OC 3.0.3.8
Strange is that currently for 2 weeks whenever we want to log in as admin, the display shows:

"Note: the account has exceeded the maximum allowed login attempts! Either try again in 1 hour or reset password."

This is hard to understand since WE did not do this.
Then the assumption is that someone is trying to perform an unauthorized login "to annoy us" ;-)

QUESTION:
What route do we need to take to move the "admin" folder out of the root directory, but not lose the actual route in the system.
It would be yes then like a hidden URL.

With the folder "storage" this was already possible at the beginning.

Does anyone have a solution?

LMP wrote: ↑

Sat Jun 04, 2022 12:21 am

Hi.
We use OC 3.0.3.8
Strange is that currently for 2 weeks whenever we want to log in as admin, the display shows:

"Note: the account has exceeded the maximum allowed login attempts! Either try again in 1 hour or reset password."

This is hard to understand since WE did not do this.
Then the assumption is that someone is trying to perform an unauthorized login "to annoy us" ;-)

QUESTION:
What route do we need to take to move the "admin" folder out of the root directory, but not lose the actual route in the system.
It would be yes then like a hidden URL.

With the folder "storage" this was already possible at the beginning.

Does anyone have a solution?

With the storage folder, it is still possible. For the admin folder, by using an extension from the Marketplace could accomplish this.

LMP wrote: ↑

Sat Jun 04, 2022 12:21 am

Hi.
We use OC 3.0.3.8
Strange is that currently for 2 weeks whenever we want to log in as admin, the display shows:

"Note: the account has exceeded the maximum allowed login attempts! Either try again in 1 hour or reset password."

This is hard to understand since WE did not do this.
Then the assumption is that someone is trying to perform an unauthorized login "to annoy us" ;-)

QUESTION:
What route do we need to take to move the "admin" folder out of the root directory, but not lose the actual route in the system.
It would be yes then like a hidden URL.

With the folder "storage" this was already possible at the beginning.

Does anyone have a solution?

I had the same problem. It was down to probes from bad traffic sources. Admin is a pretty easy username to guess. I changed the admin name and installed Ninja Firewall and Cidram bad traffic blocker. That did the job.

On some sites I've also used this:

https://www.opencart.com/index.php?rout ... load_id=49

This should work but I've never used it:

https://www.opencart.com/index.php?rout ... load_id=49

if you have a static IP Address this also helps.
Just add this to your .htaccess file in the admin area:

order deny, allow
deny from all
allow from "YOUR IP"

Replace 'YOUR IP' with your IP address. You can get it from whatsmyip.org if you don't know it already.

If you moved it out of the web root you wouldn't be able to access it. But you could rename it.

Hi,
After renaming and setting the admin directory's location in both config and htaccess, is it possible to have the admin folder inside another folder like New/DomainName/Renamed_admin rather than Renamed_admin?
I ask this as I have multiple domains all in a New/DomainNames directories for easy individual backup as the root domain in my SharedHosting server is attached to one domain so I had to keep the OC in public_html. But I would like to keep as much folders of it inside New/DomainName.
Is that possible?
Thanks

parkookk wrote: ↑

Tue Aug 13, 2024 6:09 pm

Hi,
After renaming and setting the admin directory's location in both config and htaccess, is it possible to have the admin folder inside another folder like New/DomainName/Renamed_admin rather than Renamed_admin?
I ask this as I have multiple domains all in a New/DomainNames directories for easy individual backup as the root domain in my SharedHosting server is attached to one domain so I had to keep the OC in public_html. But I would like to keep as much folders of it inside New/DomainName.
Is that possible?
Thanks

Eh
Why would renaming the admin change anything like that?

The easiest way to solve this issue by restricting admin access for certain IP-addresses only, by using this in your admin/.htaccess :
And you could also prevent fake POST requests which often don't have anything in the query string, such as route=common/login:

@paulfeaking

Because I want to keep each domain separate even the one that is connected to the root of my hosting package (cPanel)
Currently I have:
public_html/ Domain1 data
public_html/all_domains/Domain2/ Domain2 data
public_html/all_domains/Domain3/ Domain3 data
public_html/all_domains/Domain4/ Domain4 data
All Opencarts are working fine with a renamed admin.
I tried using .htaccess to point all my directories to public_html/all_domains/Domain1/ with no luck so far.
This is becasues to keep all domains organised and if I want to backup any domain, I can simply zip the domain1 and it's databases after doing any successful edits on them and if at any stage I didn't like the editing, I can simply unzip the files and drop&import the previous database.
Is there a way to move all or some of my domain1 data to public_html/all_domains/Domain1/ ?