Backend Protection
The Backend Protection tab allows you to rename the Joomla administrator URL to a custom secret path. Instead of accessing the backend at /administrator, authorized users visit a custom URL that only they know. Requests to /administrator are redirected to the public frontend (or another URL you specify).
Enabling backend protection with an incorrect or forgotten secret URL will lock you out of the Joomla backend. Keep a record of your secret URL before saving, and test access in a new browser session before closing your current session.
Enabling backend protection
A toggle switch labelled Feature Applied enables or disables the backend URL protection. When disabled, the standard /administrator path is accessible normally.
When enabled, three additional fields appear:
Options
| Option | Description |
|---|---|
| Backend URL | The secret path to use instead of /administrator. The site URL is shown as a prefix for context. Click Generate Key to create a random string. |
| Redirection URL | The relative URL to which requests to /administrator are redirected when the secret key is not provided. For example, entering contact redirects to https://yoursite.com/contact. |
| Exceptions | A list of URL strings that bypass the backend protection rule. These are needed for components or plugins that make backend AJAX requests using paths that do not include the secret key. Add exceptions one per line using the text field and the Actions dropdown (Add, Delete, Delete All). |
The secret backend URL is stored in the .htaccess file and in the SecurityCheck Pro configuration. After changing the URL, clear your browser cache and verify access before ending your current session.
