0

I am trying to hide our website's admin directory from public view as best as possible and have read the Securing Craft article. I am pleased at how easy it is to make a directory that isn't easy to guess using the cpTrigger setting in the config file.

My next thought was to disallow the directory on the robot.txt file, keeping crawlers from indexing the login page. The obvious issue with that is that now the "hidden" admin directory is in public view from our robot.txt file, not exactly what I want to do.

Is there something in the metatags or HTML of the Craft admin pages that blocks crawlers from indexing the admin pages? I was hoping to see the following on the admin pages: But they are not present. Is there a reason we would not want these by default on the Craft admin pages?

Please advise on the best practice here, perhaps I am overthinking things, or there is another way altogether to accomplish this.

2
  • 1
    TLDR Do you have the craft folder in your document root? Generally speaking it's better to have it one level about that. The robots approach should work unless Google has already indexed it. – Mark Busnelli Jr Mar 16 '18 at 23:54
  • Yes, followed everything advised on the Securing Craft webpage. The question is, does Craft have as a default, something that prevents crawlers from hitting the admin login and other pages in that directory? Seems like it should be in place already, maybe I am missing something? BTW, it is possible, using the Google Webmaster tools to remove a previously indexed page. – Jon Krane Mar 17 '18 at 0:05
2

So if you follow best practices, the craft/ directory should just never be in the public webserver root to begin with. And if it's not, search engines are never going to be able to index it.

The directories should look like this:

craft/ public/

In other words, they are side by site, and Craft is never in the public web server directory.

Craft's admin/login pages already send the x-robots-tag: none header, which tells Google et al not to index those pages. Learn More

Craft Admin Login page

I've created many Craft sites over the years, all of them still have /admin as the AdminCP trigger, none of them have been indexed, and I've had zero security breaches/brute force attacks.

Doesn't mean it can't/won't happen, but security through obscurity only gets you so far anyway. Put the craft/ directory out of the public root, follow the advice in Hardening Craft CMS Permissions and sleep well at night.

5
  • Hi Andrew, Thanks for the reply, but I am talking about exposing the admin login page to potential security issues, like a brute force attack. So my concern is, even though I am using my own cp panel route via cptrigger, that it (the admin login page) gets indexed, thus exposing the website to potential brute force attacks. While this is a public website and there are no 100% guarantees nothing will compromise security, I am looking to mitigate this risk. Basically, I am looking for a way to add the robots noindex/nofollow meta to the admin pages. – Jon Krane Mar 17 '18 at 0:29
  • @JonKrane If you're talking about a random bot coming along and finding your /admin/login page, I really wouldn't be too concerned about brute force attacks. Craft's admin/login pages already send the x-robots-tag: none header, which tells Google et al not to index those pages. – andrew.welch Mar 17 '18 at 0:33
  • I've created many Craft sites over the years, all of them still have /admin as the AdminCP trigger, none of them have been indexed, and I've had zero security breaches/brute force attacks. Doesn't mean it can't/won't happen, but security through obscurity only gets you so far anyway. Put the craft/ directory out of the public root, follow the advice in Hardening Craft CMS Permissions and sleep well at night. :) – andrew.welch Mar 17 '18 at 0:35
  • Thank you, I will accept the x-robots-tag: none as answer. I was wondering how that was being done. (I can't upvote your answer yet though) – Jon Krane Mar 17 '18 at 0:38
  • No worries, I amended my original reply with the info from the comments. Enjoy! – andrew.welch Mar 17 '18 at 0:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.