How to Change the Magento Admin URL

Changing the Magento Admin URL is a useful security measure that can reduce exposure to automated login attempts and unwanted scanning. Instead of using a predictable administrator path, you can configure Magento with a custom Admin URL.

However, changing the Admin URL should be considered an additional security layer, not a replacement for strong passwords, two-factor authentication, a firewall, or other security controls.

Why Change the Magento Admin URL?

A default or predictable Admin URL can be easily discovered by automated bots. Changing it can reduce:

• Automated brute-force attempts
• Admin login scanning
• Unnecessary bot traffic
• Exposure of the administrator login page

For example, instead of:

https://example.com/admin

you could use:

https://example.com/store-control

Choose a path that is difficult to guess and avoid using obvious words such as admin, administrator, or backend.

Before Changing the Admin URL

Create a backup before modifying Magento configuration.

It is also a good idea to have:

• SSH access to the server
• Access to the Magento filesystem
• Access to the Magento CLI
• A working database backup
• A record of the current Admin URL

If you are using a deployment system, make sure the configuration change is applied consistently across your environments.

Method 1: Change the Admin URL from env.php

Magento stores the Admin URI configuration in:

app/etc/env.php

Before editing the file, make a backup:

cp app/etc/env.php app/etc/env.php.bak

Open the file:

nano app/etc/env.php

Look for the backend section:

'backend' => [
    'frontName' => 'admin'
],

Change admin to your desired custom path:

'backend' => [
    'frontName' => 'store-control'
],

Save the file.

Your Admin URL will now become:

https://example.com/store-control

Use your actual domain name in place of example.com.

Method 2: Change the Admin URL Using Magento CLI

Magento provides a CLI command that can be used to configure the Admin URI.

From the Magento root directory, run:

php bin/magento setup:config:set --backend-frontname="store-control"

Replace store-control with your desired Admin path.

After making the change, clear the cache:

php bin/magento cache:flush

Then open the new Admin URL:

https://example.com/store-control

Method 3: Change the Admin URL During Magento Installation

If you are installing Magento for the first time, you can specify the Admin URI during installation.

For example:

bin/magento setup:install \
--backend-frontname="store-control"

The exact installation command will contain many other required options, but --backend-frontname determines the Admin URL path.

How to Find the Current Magento Admin URL

If you don’t remember your current Admin URL, inspect:

app/etc/env.php

Look for:

'backend' => [
    'frontName' => 'admin'
],

The value of frontName is the configured Admin path.

You can also inspect the configuration with Magento CLI:

php bin/magento info:adminuri

Magento should return information similar to:

Admin URI: /store-control/

Clear Magento Cache

After changing the Admin URL, flush the Magento cache:

php bin/magento cache:flush

If you are using additional caching layers such as Varnish or a CDN, clear or refresh those caches if necessary.

Test the New Admin URL

Open the new URL in your browser:

https://example.com/store-control

Verify that:

• The login page loads.
• Your administrator credentials work.
• The dashboard opens correctly.
• Products and orders are accessible.
• No redirect loops occur.
• Storefront pages continue working.

Do not close your existing administrative session until you have confirmed that the new URL works.

What If You Can’t Access the Admin Panel?

You do not need access to the Magento Admin Panel to change the Admin URL.

You can use SSH and Magento CLI:

php bin/magento setup:config:set --backend-frontname="store-control"

Then:

php bin/magento cache:flush

Alternatively, edit:

app/etc/env.php

directly.

Common Problems After Changing the Admin URL

1. The Old URL Still Works

Your browser or caching layer may still have cached information.

Try:

• Opening the new URL in a private browser window.
• Clearing Magento cache.
• Clearing Varnish/CDN cache if applicable.
• Checking app/etc/env.php.

2. 404 Error at the New URL

Verify that the frontName value was changed correctly:

'backend' => [
    'frontName' => 'store-control'
],

Then flush the cache:

php bin/magento cache:flush

Also check your web-server and Magento configuration if the problem persists.

3. Admin Login Redirects Back to the Old URL

This can occur when Magento or another caching layer is still using stale configuration.

Clear Magento cache and review the configured Admin URI:

php bin/magento info:adminuri

Then restart PHP-FPM or clear relevant server-side caches if necessary.

4. Admin Assets Do Not Load

If CSS or JavaScript files are missing after changing the URL, check your Magento deployment and static content configuration.

You may need to redeploy static content:

php bin/magento setup:static-content:deploy -f

Only do this when appropriate for your deployment workflow, as static deployment can take significant time on larger stores.

Best Practices for Magento Admin Security

Changing the Admin URL is helpful, but it should not be your only security measure.

Combine it with:

Enable Two-Factor Authentication

2FA helps protect the administrator account even if a password is compromised.

Use Strong Passwords

Every administrator should have a unique password that is not reused elsewhere.

Restrict Admin Permissions

Give users only the permissions they actually need.

Use HTTPS

Always access the Magento Admin Panel over HTTPS.

Use a Firewall or WAF

A Web Application Firewall can help block malicious requests and automated attacks before they reach Magento.

Monitor Login Attempts

Watch server and application logs for repeated failed login attempts or suspicious administrator activity.

Important Security Note

Changing /admin to another path does not make the Magento Admin Panel completely secure. An attacker may still discover a custom Admin URL through scanning, leaked links, browser history, source code, or other information.

Think of the custom Admin URL as one layer in a broader security strategy:

Custom Admin URL + 2FA + Strong Passwords + HTTPS + WAF + Least Privilege + Monitoring

Conclusion

Changing the Magento Admin URL is a relatively simple way to reduce automated attacks against your administrator login page.

The easiest approach is to run:

php bin/magento setup:config:set --backend-frontname="store-control"
php bin/magento cache:flush

Then access your Magento dashboard through:

https://example.com/store-control

Always record the new Admin URL securely and combine this change with 2FA, strong credentials, server security, and regular Magento updates for better overall protection.

Available next action: Create a downloadable PDF file here in this chat containing the plan and action items above