Configuration
The Access Key plugin has a small set of options that control how it works. Here's the full list, found under the Access Key System plugin settings.
| Access Key | The key you need to add to the login URL to reach the administrator area, for example OpenSesame. With that key set, log in at https://www.website.com/administrator?OpenSesame. |
| Whitelist IP Addresses | IP addresses (separated by commas, e.g. 127.0.0.1, 127.0.0.2) that can reach the administrator area without the access key. Supports both exact IPs and CIDR ranges (e.g. 192.168.1.0/24). |
| Your IP Address | Your current IP address, shown for convenience. Copy it into the field above to whitelist yourself. |
| Action on Failure | What happens when no access key, or the wrong one, is provided: show a message, redirect the visitor, or show your own 404 page (stealth mode). |
| Message (only visible when Action on Failure is set to Show Message) | The message shown when the access key is missing or incorrect. The administrator login screen stays hidden from this visitor. |
| Redirect (only visible when Action on Failure is set to Redirect to URL) | Where to send a visitor who doesn't provide the access key. Leave empty to redirect to the site's homepage. |
| Whitelist Message (applies to whitelisted IP addresses) | An informational message shown to whitelisted visitors who reach the administrator area without entering the access key, confirming they were let in because their IP is on the whitelist. |
Stealth mode
Available since version 2.3.0. Set Action on Failure to Show 404 Page (Stealth) and a visit to /administrator without the access key is answered with the 404 page of your own site, sent with a real 404 Not Found status code.
Where a message or a redirect still tells a scanner that something is there, stealth mode tells it nothing at all: the administrator area answers exactly like an address that does not exist on your site. There is no message to read, no redirect to follow and no login form to attack.
It is the real page, not an imitation. The plugin asks the front end of your own site for a page that is not there, keeps that answer for an hour and serves it. Whatever your template makes of its error page, including an error page built in a page builder such as YOOtheme, is what a scanner gets to see.
If your site cannot reach itself over HTTP, the plugin builds the error page of your site template instead, and if that is not possible either it falls back to a plain 404 document that names neither Joomla nor the plugin. The status code is 404 in all three cases and the login screen is never rendered.
Two things worth knowing. The request the plugin makes appears in your own statistics as a 404 on joomill-accesskey/not-found: that is the plugin asking for its page, once an hour at most. And the Message and Redirect fields do not apply in stealth mode, which is why they disappear from the settings when you select it. Your whitelist keeps working as before.
How access is granted and kept
Three things changed in version 2.3.0 that have no setting of their own but that you will notice while using the plugin.
Access expires after twelve hours
Once you enter the correct key, access is remembered on the server for twelve hours and is tied to the address you came from. Before 2.3.0 it lasted as long as your browser session. After twelve hours, or from another network, add the key to the URL again. Whitelisted IP addresses are unaffected: they never need the key.
The key disappears from the address bar
After the key is accepted you are sent on to the plain /administrator address, so the key no longer stays visible in the address bar, in your browser history, or in the referrer of links you click from that page. The key is also only read from the URL itself: it is deliberately not accepted from a submitted form, so another website cannot make your browser hand it over.
Repeated wrong keys are blocked
After ten failed attempts within fifteen minutes from the same IP address, that address is blocked and the key is not even checked any more: every visit gets whatever you configured under Action on Failure. The block lifts by itself once those attempts are older than fifteen minutes, and a successful entry clears the counter immediately. This is what stops someone guessing the key one address at a time.
Two consequences worth knowing. Whitelisted IP addresses are checked before the block, so you can always whitelist yourself out of trouble. And if you are testing your own key over and over and suddenly nothing works any more, wait fifteen minutes: you blocked yourself.