Admin Tools provides several different ways to control who can access the administrator area of your website.
You can use one method on its own, or combine several for even greater protection.
Let's start with the options in Configure WAF.
The first allows you to restrict administrator access based on IP address.
You can create a whitelist of IP addresses that are allowed to access the administrator, or a blacklist of addresses that should always be denied.
IP whitelisting provides excellent security if you always work from the same location.
However, if you regularly travel, work from different networks, or use mobile internet, your IP address may change frequently. In that case, a whitelist can quickly become inconvenient.
You can also define an Away Schedule.
This lets you prevent administrator logins during specific times of the day.
For example, if you know you'll never administer your website overnight, you could block access between 6 p.m. and 8 a.m.
While this can improve security, remember that it also prevents you from logging in during those hours, so think carefully before enabling it.
Another option is the Administrator Secret URL Parameter.
Enter a memorable word or phrase without spaces and save your changes.
Now, if someone browses to the normal /administrator URL, they won't see the Joomla login page.
Instead, they'll be redirected away from the administrator area.
To reach the login page yourself, add your secret parameter to the administrator URL.
Once you've done that, you can log in exactly as normal.
This doesn't replace your Joomla login credentials, but it does make it much harder for automated attacks to even find your administrator login page.
Another option is Administrator Password Protection.
This adds a completely separate username and password before the Joomla login page is displayed.
Enter the username and password you want to use.
Choose a strong password, and don't reuse your Joomla administrator password or any password you use elsewhere.
Click Password Protect.
You'll immediately be asked to authenticate using the new credentials.
From now on, anyone visiting the administrator URL must first enter this additional username and password before they can even see the Joomla login screen.
This provides another valuable layer of protection against automated attacks.
The final feature we'll look at is Emergency Offline.
This is designed for situations where you need to take your website offline immediately.
When you enable Emergency Offline, Admin Tools updates your .htaccess file so that visitors are redirected to a file named offline.html.
Before using this feature, you should create an offline.html file in the root of your website explaining that the site is temporarily unavailable.
Otherwise, visitors will simply see a "File Not Found" message.
I'll enable Emergency Offline now.
"When you enable Emergency Offline, your current IP address is automatically allowed through and you can still access the website and continue working/ If your IP address changes—for example, if you switch networks or your ISP assigns you a new address—you'll no longer bypass the offline mode."
Because my current IP address is automatically exempted, I can still access the website and continue working.
When you're ready to bring the site back online, return to Emergency Offline and click Set Online.
Your website immediately becomes available to visitors again.