Skip to main content

Joomla Access Key

Hide your Joomla administrator login behind a secret key in the URL. No key, no login form: just a message, a redirect or your site's own 404 page. The bots that hammer /administrator with brute-force attempts never even see a login to attack.
Download free
Free and open source Joomla 5 and 6 IP whitelist with CIDR

Latest version: 2.4.0 - 7 October 2026

Demo
Documentation
JED
Why Access Key

Your login form is the most attacked page on your site

Every Joomla site keeps its login in the same place: /administrator. Bots know this. Around the clock they throw username and password combinations at a form that is visible to the entire internet. Even when they never get in, the traffic floods your logs, wastes server resources and sits one leaked password away from a real breach.

Access Key removes the target. With the plugin enabled, the administrator login only appears for someone who carries your secret key. Everyone else, every bot included, gets a message, a redirect or a 404. There is no form to brute-force, because there is no form at all.

Browser with the secret key in the administrator address and the Joomla login form visible
What it does

Everything in one small plugin

Pick a key, decide what happens to everyone without it, and you are protected. No template edits, no extra services, no front-end impact.
Hide the login

One secret key, and a whitelist for the places you trust

Choose a key and add it to the administrator address as ?YourSecretKey. Only requests that carry the key reach the real login screen.

Your own office or home connection can skip the key. Add single IP addresses or whole networks in CIDR notation, IPv4 and IPv6. The settings screen shows your current IP address, so you can copy it straight into the whitelist.

Access Key plugin settings with the key, the IP whitelist and the action on failure
Without the key

Three answers for everyone else

You decide what a visit to /administrator without the key gets.

  • Show a message. Your own text, sent with a 401 status.
  • Redirect to a URL. Any address you like, or your home page when you leave it empty.
  • Show a 404 page. Stealth mode, for when the backend should not seem to exist at all.

Whichever you pick, the login form is never rendered.

The three responses for visitors without the key: a message, a redirect or a 404 page
Stealth mode

A backend that looks like it is not there

A message or a redirect still tells a scanner that something is there. Stealth mode answers with a real 404 status and the 404 page of your own site template.

The page is fetched from your front end and cached for an hour, so it is the real error page of your template, also with page builder templates. Nothing in the response names Joomla or the plugin.

The administrator address answering with the 404 page of the site in stealth mode
Joomla Action Log

See who came in, and who was turned away

Switch on the action log option and every access decision shows up in the Joomla action log: entry with the key, entry from a whitelisted address, refused entry and lockouts.

Repeated refusals from the same visitor are recorded once every fifteen minutes, so a scanner cannot flood the log or the notification emails. The IP address is only written when IP logging is enabled in the Action Logs options.

Joomla action log with granted, denied and blocked access to the administrator area
Whole networks

CIDR ranges

Whitelist an entire network such as 192.168.1.0/24 instead of listing every address by hand.
Throttling

Locks out guessing

After ten failed attempts within fifteen minutes an IP address is locked out and the key is no longer checked for it.
No lockouts by typo

Key checked on save

A key that could never work, or that Joomla uses itself in backend addresses, is refused before it can lock you out.
No friction

Stays out of the way

Enter once and access stays open for twelve hours for your IP address. The key leaves the address bar and the front end is never touched.
How it works

From bot magnet to closed door in three steps

  1. 1
    Install and set a key
    Enable the plugin, enter your access key and save. The key is checked on save, so a key that could never work is refused before it locks you out.
  2. 2
    Open the backend with the key
    Add ?YourSecretKey to the administrator address. The plugin accepts it and sends you on to the clean address, so the key does not stay in the address bar or the browser history.
  3. 3
    Work as usual
    Access stays open for twelve hours for your IP address. Everyone without the key gets your message, your redirect or a 404.
The Access Key plugin settings in the Joomla administrator
The plugin settings in Joomla 6.
Under the hood

Built for security, the Joomla way

Admin only

Front end untouched

The plugin acts on the administrator area and nothing else. Your public site and its visitors are never affected.
No spoofable IPs

A whitelist you can trust

Only the real connection IP is trusted. Forwarded headers such as X-Forwarded-For count only when Joomla is configured as running behind a load balancer.
Hardened access

Careful with the key

The key is only read from the web address, never from a form or a cookie. Access is tied to your IP address and the session id is renewed when access is granted.
Joomla 5 and 6

Modern codebase

A namespaced system plugin with a service provider. No database tables, no template overrides, no core changes.
Honest about security

An extra layer, not a magic shield

Access Key is an extra layer in front of the Joomla login. It keeps bots and casual visitors away from the login form and takes the noise out of your logs. It does not replace strong passwords, multi-factor authentication or keeping Joomla up to date. The key travels in the address, so treat it like a password and only share it over a channel you trust.
Questions

Frequently asked questions

What does the Access Key plugin do?
It hides your Joomla administrator login behind a secret key in the URL. Without the key, visitors and bots never see the login form. They get a message you define, a redirect or the 404 page of your site instead. It is a simple, effective layer that keeps automated brute-force attacks away from your login.
How do I log in once it is enabled?
Append your key to the admin URL, for example https://www.website.com/administrator?YourSecretKey. The plugin sends you on to the clean address, the normal Joomla login appears and you sign in as usual. Access then stays open for twelve hours for your IP address, so you do not need the key on every click.
Is this a replacement for a strong password or two-factor authentication?
No, and it is not meant to be. Access Key is an extra layer (defense in depth). It stops bots from ever reaching your login form, which removes the vast majority of brute-force attempts, but you should still use a strong, unique password and two-factor authentication.
What happens if someone visits /administrator without the key?

You decide. Choose "Show Message" to display a custom message (the default is "There is nothing to see here!"), "Redirect to URL" to send them to any address, or "Show 404 Page (Stealth)" to answer with your own 404 page and a real Not Found status. Either way the login form is never rendered.

What is stealth mode?
Stealth mode answers a keyless visit to the backend with the 404 page of your own site, sent with a real 404 Not Found status code. A message or a redirect still tells a scanner that something is there; a 404 tells it the address does not exist. The page is the real one: the plugin asks your front end for a page that is not there and caches that answer for an hour, so your template's own error page is what gets served. If the site cannot reach itself, it builds that error page in the backend, and failing that it returns a plain 404 that names neither Joomla nor the plugin.
Can I skip the key from my own office or home?
Yes. Add your IP address, or a CIDR range such as 192.168.1.0/24, to the whitelist and those visitors reach the login without the key. The plugin shows your current IP address so you can whitelist it in one click.
Does the IP whitelist work behind Cloudflare, a proxy or a load balancer?
By default the plugin only trusts the real connection IP, because forwarded headers can be spoofed. If your site genuinely sits behind a trusted proxy or load balancer, enable “Behind Load Balancer” in Joomla’s Global Configuration (Server tab) and the whitelist will use the forwarded IP again.
Help, I forgot my key and locked myself out!
No problem. With FTP access, rename the plugins/system/accesskey folder (for example to --accesskey) to get back in, then set a new key. With database access, run UPDATE #__extensions SET enabled = 0 WHERE name = 'PLG_SYSTEM_ACCESSKEY', log in and choose a new key. The full guide is in the documentation.
Does it affect the front end or my visitors?
No. The plugin only ever acts on the administrator area. Your public website and everyone visiting it are completely untouched.
Which Joomla versions are supported?
Access Key supports Joomla 5.x and 6.x.
In which languages is the plugin available?
The plugin interface is available in six languages: English, Dutch, German, French, Spanish and Italian.
Is it really free?
Yes. Access Key is GPL licensed and free to use on as many Joomla sites as you want.
How do I install it?
Download the package from the Joomill website and install it through System > Install > Extensions using the Upload Package File tab. The plugin is published automatically. Note that enabling it logs you out, so set your key and keep a backup before you switch it on.

Lock down your Joomla login in two minutes

Free, GPL licensed and yours to use on as many Joomla sites as you want. Set a key, pick a message, a redirect or a 404, and the bots are locked out.
Download the Free version
Get Bundle - €65
One license, unlimited sites · Personal support from the developer