Magento 2 Admin IP Whitelist: Backend Only for Approved Addresses
SKU: ADMINIPWHITELIST1
- admin reachable only from approved IPs and networks
- IPv4, IPv6 and CIDR, approvals with expiry date
- emergency access via console and secret key
- log of blocked requests with retention period
Einmaliger Kauf · inkl. 12 Monate Updates · zzgl. MwSt.
Magento 2 Admin IP Whitelist: backend only from approved addresses
With the Mironsoft Magento 2 Admin IP Whitelist only approved IP addresses and networks can reach your admin area. Everyone else sees a neutral error page before the login form even appears. You maintain the list in the backend, enter single addresses or whole network ranges and keep control through an emergency access even when your own address changes. The storefront pages of your shop are not affected.
Single IP addresses
Enter IPv4 and IPv6 as single addresses, with a label and a note on who owns them.
Network ranges
Approve whole ranges in CIDR notation, such as the office network or a VPN pool.
Time-limited
Approvals with an expiry date, for example for service providers during a project.
Emergency access
A console command and a secret emergency key lift the block if you have locked yourself out.
Block log
Blocked requests with time, address and path, optionally with an email notification.
Why a Magento 2 Admin IP Whitelist reduces the attack surface
The admin area is the target of automated attacks: bots try passwords, look for known paths and probe outdated modules. A strong password and two-factor login help, but the login form stays reachable for the whole world. Every attempt loads the server and fills the log files.
A Magento 2 Admin IP Whitelist turns the principle around. Whoever is not on the list never reaches the form. That saves server load, makes attacks pointless and combines with the protections you already have. For teams with a fixed office or a VPN it is one of the most effective measures for little effort.
Magento 2 Admin IP Whitelist: manage addresses and networks in the backend
You find the list of the Magento 2 Admin IP Whitelist in the admin under the module menu. Every entry consists of an address or network range, a label and optionally an expiry date. A CSV import makes the start easier, an export documents the current state. Changes apply at once, without clearing the cache and without restarting the server.
- IPv4, IPv6 and CIDR ranges
- Label and note per entry
- CSV import and export of the list
What outsiders see: a neutral error page instead of the login form
Depending on the setting, the Magento 2 Admin IP Whitelist gives an address that is not approved a 403 page, a 404 page or a redirect to the home page. The login page and the admin path are not given away. Subpages and asset paths of the backend are covered as well. The check runs early in the process, before the session starts, and therefore costs hardly any processing time.
- 403, 404 or redirect selectable
- Check before the session starts
- Subpages of the backend included
Detect the real address behind a proxy, load balancer or CDN
If the shop runs behind a proxy, the server initially sees only its address. That is why you enter trusted proxies in the configuration and choose the header from which the visitor address is read. Headers from unknown senders are ignored so that nobody can fake an address. This way the Magento 2 Admin IP Whitelist also works reliably with a CDN in front.
- Enter trusted proxies
- Choose the header for the visitor address
- Forged headers from unknown senders ignored
Emergency access and log for when your own address changes
If your address changes or the VPN fails, the emergency access helps. Through the console you disable the check with one command, or you open a secret address with the emergency key, which is valid for a limited time. Every emergency access and every blocked request ends up in the log. The stored addresses are personal data, so you set the retention period and the shop operator checks the legal side.
- Console command to disable
- Emergency key with expiry
- Log with adjustable retention
Where the Magento 2 Admin IP Whitelist helps in daily work
Typical situations in which a fixed access list creates security.
Team with a fixed office network
All staff work from the office or over a VPN. The admin is reachable only from these networks, every outside request leads nowhere.
External service providers
An agency receives a time-limited approval for the project period. After the expiry date the access closes by itself.
Shops targeted by bots
Anyone who sees thousands of login attempts in the log every day relieves the server and the log files with the Magento 2 Admin IP Whitelist and calms the evaluation.
Addition to two-factor login
Two-factor login checks the person, the Magento 2 Admin IP Whitelist checks the place. Both together close more gaps than either alone.
Magento 2 Admin IP Whitelist: without and with the module
The difference to an open login form.
| Topic | Without the module | With Mironsoft Admin IP Whitelist |
|---|---|---|
| Reachability | Login form visible worldwide | Only from approved networks |
| Server load | Every bot attempt reaches Magento | Rejected before the session starts |
| Service providers | Permanent access | Time-limited approval |
| Lockout | No protection against misconfiguration | Warning and emergency access |
| Evidence | Scattered log lines | Block log |
How we set up the Magento 2 Admin IP Whitelist for you
The process after your order.
Briefing
You tell us office addresses, VPN ranges and service providers who need access, and whether a proxy or CDN sits in front.
Installation
We install the module and enter the addresses. The Magento 2 Admin IP Whitelist stays in test mode at first, without blocking.
Emergency access
We set up the console command and the emergency key and decide together where the key is stored safely.
Test
We check access from approved and foreign networks, behind the proxy and with expired entries.
Go live
Only after the test do we activate the block and introduce your team to maintaining the list.
Scope compared with Security Suite, Google reCAPTCHA and brute force protection
The Mironsoft Security Suite bundles general protective measures for the shop, Google reCAPTCHA checks whether a human fills in the form, and brute force protection locks after failed logins. The Magento 2 Admin IP Whitelist works upstream: it decides solely by the origin of the request whether the admin is reachable at all.
All modules can be combined. The administration in the admin needs no additional JavaScript library.
No download, but a personal setup
The Magento 2 Admin IP Whitelist is not listed here as a finished download file for self-installation. The purchase is a commission: we contact you after the purchase, install the module in your shop and agree addresses, emergency access and block page with you.
Frequently asked questions
Everything important about approval, emergency access, proxies and how the purchase works.
How can I allow the Magento 2 admin only for certain IP addresses?
What happens if my IP address changes?
Are IPv6 addresses supported too?
Can I limit approvals in time?
Does it work behind a proxy or CDN?
Are the shop and the customers affected?
Does the Magento 2 Admin IP Whitelist work with Hyvä?
How are stored IP addresses treated under data protection law?
Does the list replace two-factor login?
Can I download and install the module myself?
Recently Viewed Products
Magento 2 Admin IP Whitelist – Mironsoft