What it does

Every Joomla backend lives at /administrator, and every bot knows it. Login forms get probed around the clock, long before a password or two-factor check comes into play.

Access Key takes the login form out of sight. You pick a secret word, and from then on the administrator only opens when that word is in the address:

https://www.example.com/administrator?YourSecretKey

Anyone who visits /administrator without the key never reaches the login form. The front end of your site is not touched.

How it works

1. Install and set a key. Enable the plugin, enter your Access Key, save. The key is checked on save, so a key that could never work is refused before it locks you out.
2. Open the backend with the key. Add ?YourSecretKey to the administrator address. The plugin accepts it and immediately sends you on to the clean address, so the key does not stay in the address bar, the browser history or in outgoing links.
3. Work as usual. Access stays open for twelve hours for your IP address. After that you add the key again.

What visitors without the key get

You choose one of three responses:

• Show a message. Your own text, sent with a 401 status.
• Redirect to a URL. Any address you like, or the home page of the site when you leave it empty.
• Stealth mode. A 404 status with the 404 page of your own site template. To a scanner the administrator folder looks like it does not exist. The page is fetched from your front end and cached for an hour, so it is the real error page of your template, also with page builder templates.

IP whitelist

Trusted addresses can skip the key. Enter single IP addresses or whole networks in CIDR notation, such as 192.168.1.0/24. IPv4 and IPv6 are both supported. The configuration screen shows your current IP address, so you can copy it straight into the whitelist.

Whitelisted visitors can get an optional notice telling them they came in without the key, with a text you can edit.

Forwarded headers such as X-Forwarded-For are only trusted when Joomla is configured as running behind a load balancer. Otherwise a visitor could forge a whitelisted address.

Protection against guessing

• After ten failed attempts within fifteen minutes an IP address is locked out, and the key is no longer checked for that address.
• The key is only read from the web address, never from a submitted form or a cookie.
• Access is tied to the visitor's IP address and expires after twelve hours.
• The session id is renewed at the moment access is granted.
• IP addresses are stored as a hash, in the session and in the attempt counter.

Joomla Action Log

Switch on the action log option and every access decision appears in Users > Action Logs: entry with the key, entry from a whitelisted address, refused entry, and lockouts after too many attempts. Repeated refusals from the same visitor are recorded once every fifteen minutes, so a scanner cannot flood the log or the notification emails. The IP address is only written to the log when IP logging is enabled in the Action Logs options.

What it is, and what it is not

Access Key is an extra layer in front of the Joomla login. It keeps bots and casual visitors away from the login form and takes the noise out of your logs. It does not replace strong passwords, multi-factor authentication or keeping Joomla up to date. The key travels in the address, so treat it like a password and only share it over a channel you trust.

Locked yourself out? The documentation has a step-by-step page for a forgotten key.

Technical details

• System plugin, built on the namespaced Joomla plugin architecture with a service provider
• Joomla 5 and Joomla 6, PHP as required by your Joomla version
• Only runs on administrator requests
• No database tables, no template overrides, no core changes
• Interface in English, Dutch, German, French, Italian and Spanish
• Updates through the Joomla update system

Free

Access Key is free and licensed under the GNU GPL version 3 or later.