Server overloaded, nginx logs full of requests to /admin. Bots tried to log into the admin panel for 72 hours – 50,000 attempts. One admin account had a weak password. Response time: 30 minutes, hardening: 2 hours.
Symptoms
- Server under heavy load with no visible business reason
- Nginx access log: hundreds of POST requests to
/admin/admin/index/per second - Admin account locked by Magento’s protection mechanism
- In
var/log/debug.log: thousands of failed login entries
Immediate response
# Find top attacking IPs
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20
# Block in nginx
# deny 185.220.101.0/24;
# Or use fail2ban
# [nginx-magento-admin]
# enabled = true
# maxretry = 10
# bantime = 3600
Hardening
# 1. Change admin URL to unique path
bin/magento setup:config:set --backend-frontname=myadmin_$(openssl rand -hex 4)
# 2. Restrict admin access by IP in nginx
location /myadmin_abc123/ {
allow 1.2.3.4; # office IP
allow 5.6.7.8; # VPN IP
deny all;
}
# 3. Enable 2FA for all admin accounts
bin/magento module:enable Magento_TwoFactorAuth
bin/magento setup:upgrade
Takeaways
The /admin URL is the first target of every scanner. Changing the URL + IP whitelist + 2FA is the minimum. Fail2ban automatically blocks attackers based on log patterns.
