How to restrict access to your admin area

Protect an admin or staging area by IP allow-listing or HTTP basic authentication on TurboStack, with and without Varnish.

Lock an admin area (for example /wp-admin) or a whole staging site so only you can reach it. There are two approaches, which you can combine: an IP allow-list, and HTTP basic authentication.

Before you start

SSH access to the host - see SSH access.
See custom Nginx configuration for how ~/nginx works.

Option 1: IP allow-list

Restrict a path to known addresses in ~/nginx/50main.conf:

location /admin/ {
    allow 203.0.113.10;
    deny all;
}

For allow/deny rules that cover a whole site rather than one path, see Block or allow IP addresses.

Option 2: HTTP basic authentication

Ask for a username and password, optionally letting trusted IPs skip the prompt.

Install the apache2-utils package (it provides htpasswd) by adding it to os_extra_packages and publishing:
```
os_extra_packages:
  - apache2-utils
```
Generate a password file over SSH:
```
htpasswd -c /var/www/prod/.secrets/htpasswd prod
```
You are prompted for a password - use a long, complex one.

Enable it on a location in ~/nginx/50main.conf:

location / {
    auth_basic "Restricted area";
    auth_basic_user_file /var/www/prod/.secrets/htpasswd;

    # optional: trusted IPs skip the login prompt
    allow 203.0.113.10;
    satisfy any;
}

If Varnish is enabled, these rules belong in a different file - see When Varnish is enabled.

When Varnish is enabled

With Varnish, Nginx runs in two places: a front server that terminates HTTPS and passes the request to Varnish, and a backend server that Varnish requests when it has nothing cached. ~/nginx/50main.conf belongs to the backend.

Varnish answers a cached page itself, without asking Nginx. A rule in 50main.conf is therefore only checked when a request reaches Nginx, and a page that is already in the cache still goes out to anyone, without a login prompt.

Put the rules in front of the cache instead, in ~/nginx/outside/main/30basic_auth.conf:

auth_basic "Restricted area";
auth_basic_user_file /var/www/prod/.secrets/htpasswd;

# optional: trusted IPs skip the login prompt
allow 203.0.113.10;
satisfy any;

That file is included inside the front server's location /, so write the directives on their own - do not wrap them in a location block. The password file is the same one from Option 2.

The same applies to Option 1: for a site with Varnish, allow and deny rules belong in ~/nginx/outside/main/ too - see Block before Varnish.

Note

The ~/nginx/outside/ directory only exists when Varnish or a reverse proxy is enabled. If it is not there, use 50main.conf.

Important

A login prompt at the front applies to every visitor, including uptime monitoring. A monitoring_url that points at the protected site reports it as down. Give the check its own login by including the credentials in the address it calls: https://monitor:password@example.com/.

Apply and verify

tscli nginx reload

Visit the protected path: you should be asked to log in (or be allowed straight through from a trusted IP), and blocked otherwise.

Warning

Editing 50main.conf can take the site offline if a rule is wrong. tscli nginx reload validates the config and reports the error. If you are unsure, contact support.

Configure Nginx
Block or allow IP addresses
Configure Varnish - check whether the cache is enabled
Installing extra OS packages
Security hardening