Password protect admin folder??

Hi to all

I was just wondering if it would be beneficial to password protect the admin folder ? i use xcart software for a shop that i run which the admin folder i password protect, just wondered if it would be a good idea if i done that on zen cart or if i would mess it up by doing this.

Many thanks

If you mean password protecting it in CPanel (for example), can't hurt. I think a properly re-named admin folder and a proper password should be enough.

its a great idea and i did that some while ago on my server, using parallels pro to protect folders..

but having to go through two sets of username and password stages to get into the admin soon became annoying as hell so I scrapped it and I think having a well renamed admin and long alphanumeric admin username and password is enough.

I did see a post a few days back about locking the admin folder down to only be viewable by certain IP address via .htaccess, thats a great idea but not had the time to try it

Yes, either or both of these can help.

Use a .htpasswd file (listed in your .htaccess file) to define one username and password that can access this folder.

Use "allow" and "deny" statements in your .htaccess file to block access to all IP addresses except those from either your own IP address or from a very small block of IP addresses (if your IP address changes from day to day).

medeano:

I was just wondering if it would be beneficial to password protect the admin folder ?

It doesn't hurt! :)

Hey Guys, it sounds like a great idea.

I do use my admin from only one IP ( my office)

Can someone please provide us with the .htaccess/pwd file/code to be placed so that my admin is only assiceeble from my ip? and how to implement it.

I am willing to 'buy a cup of coffee' for this code, and steps to implement it on my vps.

Thanks in advance.
ZC version 1.3.8
Linux vps

samar777:

Hey Guys, it sounds like a great idea.

I do use my admin from only one IP ( my office)

Can someone please provide us with the .htaccess/pwd file/code to be placed so that my admin is only assiceeble from my ip? and how to implement it.

I am willing to 'buy a cup of coffee' for this code, and steps to implement it on my vps.

Thanks in advance.
ZC version 1.3.8
Linux vps

Vger made a great point once about Admin security. If you protect your Admin folder by IP address, and your ISP gives you a dynamic IP address you can 'lock' yourself out of your admin

Shane78:

Vger made a great point once about Admin security. If you protect your Admin folder by IP address, and your ISP gives you a dynamic IP address you can 'lock' yourself out of your admin

Only momentarily until you update the list of IP Addresses allowed to access your admin (through CPanel, ftping an .htaccess file, or whatever means you did the original restriction).

swguy:

Only momentarily until you update the list of IP Addresses allowed to access your admin (through CPanel, ftping an .htaccess file, or whatever means you did the original restriction).

And that can be a pain in the proverbial as well :blush:

It makes sense.

so what about this awesome code guys? : ) can I get my hands of it please.

http://tools.dynamicdrive.com/password/

You might try this tool.