Magento Admin Security: Login URL, 2FA, Roles and Access Logs

The Magento admin login is the single most valuable door into your store, and it should be hard to find, hard to open and fully recorded. In practice that means a non-default admin URL, two-factor authentication for every user, roles that grant only what each person needs, network rules that keep strangers away from the login page, short sessions and lockouts, and an audit trail you actually review. Everything on that list is available in Magento Open Source or Adobe Commerce today; most stores just have not switched it all on.

Below is a hardening checklist with the Admin path or command for each item, followed by notes on the settings that cause the most trouble.

Finding the admin login (and recovering access)

The admin URL is set by the "frontName" value in app/etc/env.php. If you have lost it, a developer with server access can read it there. Useful recovery commands, run from the Magento root:

# show or change the admin path
bin/magento info:adminuri
bin/magento setup:config:set --backend-frontname="your-unique-path"

# unlock a user after too many failed logins
bin/magento admin:user:unlock <username>

# reset a user's 2FA provider so they can enrol again
bin/magento security:tfa:reset <username> google

Never share one admin account between people to "save seats". Every person gets their own user, which is what makes roles, 2FA and audit logs mean anything.

The admin hardening checklist

Notes on the controls that matter most

Custom URL: useful, but not a lock

Adobe lists a non-default admin URL among its top security recommendations because it removes you from automated scripts that probe /admin. It is obscurity, though, not protection. If the path leaks through a browser extension, an old email or a contractor's notes, the rest of this checklist still has to hold.

Two-factor authentication

2FA in Magento applies to the Admin only, not to customer accounts. Adobe describes it as secure by default in 2.4 and strongly recommends not disabling it. Teams sometimes switch it off on staging and then copy that configuration to production; check this after every deployment. In 2.4.7 and later, an OTP window setting controls how long an expired one-time password is still accepted. If your company signs in through Adobe IMS, native 2FA is replaced by your identity provider's controls.

Roles: design them around jobs

Create roles such as "Customer service", "Merchandiser", "Marketing" and "Finance", and grant each only the resources it needs. A few rules of thumb:

• Only two or three people should hold the full Administrator role.
• Keep System > Permissions, Integrations, and Stores > Configuration out of everyday roles. Configuration access is enough to change payment, email and URL settings.
• Give agencies and freelancers their own users with expiry dates in your offboarding list, and remove them when the project ends.
• Review All Users quarterly. Adobe's security guidance calls for regular audits of users and roles.

Network rules beat everything else

The strongest single control is not letting the public reach the admin path at all. Restrict it to your VPN or office IP ranges at the web server, the WAF or the CDN. On Adobe Commerce on cloud infrastructure, Adobe documents a Fastly Edge ACL with a custom VCL snippet that returns 403 for the admin path unless the client IP is allowlisted. If your team works from changing locations, a VPN is easier to manage than chasing home IPs.

Audit trail

Adobe Commerce includes Action Logs: it records changes made by admin users, with the user, action, result, object ID, IP address and date. You choose which action groups to log under Stores > Settings > Configuration > Advanced > Admin, and set archive retention under Advanced > System. Magento Open Source does not include this; use a reputable admin action log extension, plus web server logs for the admin path. Whatever the tool, someone must look at it. A monthly 15-minute review of new users, role changes and configuration changes catches most problems early.

Signs your admin may already be compromised

• Admin users you do not recognize, or a known user logging in at odd hours or from new countries.
• New integrations or API tokens nobody requested.
• Unexpected changes to payment methods, checkout scripts, CMS blocks or the "Miscellaneous Scripts" design field.
• Changed sender addresses or email templates.

If you see any of these, follow an incident process rather than quietly deleting the user. Our guide on what to do when a Magento store is hacked covers containment and cleanup, and a periodic Magento store audit is a good time to rerun this checklist.

Patching is part of admin security

Many admin takeovers start with a known vulnerability, not a guessed password. Stay on a supported release line: as of November 2026, 2.4.9 has standard support to May 31, 2029 and 2.4.8 to May 31, 2028, while 2.4.6 left standard support on August 11, 2026. Apply security patches promptly; our explainer on Magento security patches shows how to read Adobe's bulletins and plan the work.

FAQ

What is the default Magento admin URL?

Adobe recommends a custom Admin URL that is not easy to guess, but many stores still use /admin. Check app/etc/env.php or run bin/magento info:adminuri.

Can I turn off 2FA for one user?

Not per user in core. You can reset a user's provider so they re-enrol, and choose which providers are allowed. Disabling the module removes 2FA for everyone, which Adobe recommends against.

Is hiding the admin URL enough?

No. Combine it with 2FA, IP restriction, lockouts and patching.

Keeping the admin locked down

Most of this checklist takes an afternoon to configure; the hard part is keeping it true after staff changes, deployments and upgrades. Mistri's Magento support and maintenance includes regular access reviews and patching, and if your store is on an unsupported version, our Magento upgrade services get you back onto a release that still receives security fixes.

Sources

Configure Admin security (Adobe Experience League); Two-factor authentication (Adobe Experience League); Action logs (Adobe Experience League); Secure your Commerce site and infrastructure (Adobe Experience League); Fastly VCL allowlist for the Admin (Adobe Experience League); OAuth configuration reference (Adobe Experience League); Two-factor authentication module, security:tfa:reset command (magento/security-package on GitHub).