Is your admin panel open without a login?
Common admin and database tool addresses on your site, and whether any of them open without asking for a login.
Why it matters
An admin panel that opens without a login can give a stranger control of your app and its data. Database tools such as phpMyAdmin or Adminer left reachable are a common target.
How a survey checks it
Verified check: runs once you prove you own the site.
This is a verified check. We open a fixed list of common addresses. Only a panel that clearly opens without a login, or a reachable database tool, counts as a finding. A login page is the good result and is noted for your information.
How to fix it
- Put every admin area behind a login, ideally with two-factor authentication.
- Remove database tools from production, or limit them to your own IP addresses.
- Check that the admin area is protected on the server, not only hidden in the menu.
Prefer us to do it? Ask for a fix quote
Common questions
My admin page has a login. Is it safe?
Having a login is the first step. An audit looks further, at things like rate limiting, password rules and whether the pages behind the login check permissions properly.
Why not report every admin address found?
Because a login page is exactly what should be there. We only report what is clearly a problem, to keep false alarms out of your report.