Should I hide or rename the administrator folder?
You can't rename it, but you can protect it with a password in your hosting panel or a secret URL from a security extension.
What helps and what doesn't
You can't rename the administrator folder: Joomla and its updates expect it there. Hiding it doesn't replace good passwords and MFA, but limiting who can reach it does stop most automated login attempts.
Options
- Limit by IP address (the official best practice) in
.htaccessor your hosting panel, if you log in from fixed addresses. - Password-protect the folder in your hosting panel: a second login before Joomla's login form.
- Secret URL parameter from a security extension (for example Admin Tools), so
/administratoralone shows nothing. - Always combine with multi-factor authentication.
Good to know
- Keep a way back in: note the password-protection details and how to remove them, in case you lock yourself out.
Sources
- Security Best Practices – Joomla User Guide
- Password Protect Directories – Joomla User Guide
- Multi-factor Authentication – Joomla User Guide
