1

In my website there are no accounts except for those of moderators and administrators. That's why I don't want to show the login form to everyone but to these people.

I thought of using a weird URL for the login form like www.example.com/1a79a4d60de6718e8e5b326e338ae533 that only admins and mods would know. But it's a quite impractical solution, besides if someone would want to login in another computer and forgets this URL, then is unable to. Is there any more effective way?

2 Answers 2

2

If you want a completely private solution, then tell the admins and moderators to log to http://www.example.com/login/, there you can have a security measure with .htpasswd to prevent the access to any other person.

If the login fails, the system will just tell the user that he/she can't log and that's it.

If you know the ip's of those users that you want to let in, you can restrict access to that page according to those ip's, but that could be troublesome.

Then, since you won't have any link pointing to that folder, no robot will find it. Although heuristically they can try that url. You can forbid that in your robots.txt and or siteap, but the best option is to just use the .htpasswd to restrict access.

1
  • Interesting, I didn't know about .htpasswd, it does sound more secure than a PHP login script. Also, good advice about restricting access to certain IPs. Thanks!
    – federicot
    Commented Oct 30, 2012 at 21:45
1

On top of PatomaS's answer, you need to place the .htpasswd file in the same directory as the admin login page.

You can use this .htpasswd generator to create the file and then simply upload it to your directory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.