# How to restrict access to your admin area

Lock an admin area (for example `/wp-admin`) or a whole staging site so only you can reach it. There
are two approaches, which you can combine: an **IP allow-list**, and **HTTP basic authentication**.

## Before you start

- **SSH access to the host** - see [SSH access](../../platform/hosts/ssh.md).
- See [custom Nginx configuration](configure.md#custom-nginx-configuration) for how `~/nginx` works.

## Option 1: IP allow-list

Restrict a path to known addresses in `~/nginx/50main.conf`:

```nginx
location /admin/ {
    allow 203.0.113.10;
    deny all;
}
```

For allow/deny rules that cover a whole site rather than one path, see
[Block or allow IP addresses](block-ip-addresses.md).

## Option 2: HTTP basic authentication

Ask for a username and password, optionally letting trusted IPs skip the prompt.

1. Install the `apache2-utils` package (it provides `htpasswd`) by adding it to
   [`os_extra_packages`](../../platform/hosts/advanced/install-packages.md) and publishing:
   ```yaml
   os_extra_packages:
     - apache2-utils
   ```
2. Generate a password file over [SSH](../../platform/hosts/ssh.md):
   ```bash
   htpasswd -c /var/www/prod/.secrets/htpasswd prod
   ```
   You are prompted for a password - use a long, complex one.
3. Enable it on a location in `~/nginx/50main.conf`:
   ```nginx
   location / {
       auth_basic "Restricted area";
       auth_basic_user_file /var/www/prod/.secrets/htpasswd;

       # optional: trusted IPs skip the login prompt
       allow 203.0.113.10;
       satisfy any;
   }
   ```

## Apply and verify

```bash
tscli nginx reload
```

Visit the protected path: you should be asked to log in (or be allowed straight through from a
trusted IP), and blocked otherwise.

> [!WARNING]
> Editing `50main.conf` can take the site offline if a rule is wrong. `tscli nginx reload` validates
> the config and reports the error. If you are unsure, [contact support](../../platform/support.md).

## Related

- [Configure Nginx](configure.md)
- [Block or allow IP addresses](block-ip-addresses.md)
- [Installing extra OS packages](../../platform/hosts/advanced/install-packages.md)
- [Security hardening](../../concepts/security-hardening.md)
</content>