How to organize the security of the admin panel?

Question

PHP

There is a self-written PU in PHP, which is essentially used on one PC. I began to notice that enterprising citizens are trying to brute it, inject it, etc.
I temporarily closed it via htaccess for access to 1 IP, the only problem is that I have a dynamic IP, and the telecom operator does not allow me to buy a static one ...
I know that there are some certificates that are installed on the PC, and the site checks this certificate - a question how to implement? What is the price? Thank you.

Answer 1

If for yourself - make a self-signed certificate, import it into your browser, and in the settings of your web server, require it when connecting.

Answer 2

I'll tell you a secret: through .htaccess you can write octets and subnets!
You can write (the dot at the end is MANDATORY!): xxx.xxx.xxx.
or xxx.xxx.xxx.0/24 etc.
And thus allow access only for your subnet.
And the question is: how do "enterprising citizens" know the link to your admin panel?)

Answer 3

There is a self-written PU in PHP, which is essentially used on one PC.

Why post it on the internet? Yes, so much so that even bots have found it and are trying to send forms.

Answer 4

Just rename the admin folder or the admin.php file itself to admin558xYttwz.php

Answer 5

The certificate for authentication is already necessary to dig into the IPsec area, and this is a very difficult technology. In your case, you can move the admin panel to a separate non-standard hostname and non-standard port. You can restrict access with a firewall, but not for one IP, but for the entire network of your provider, if you are sure that you will climb into this admin panel only from home.
If you are sure that the admin panel is 100%, and they can break even without knowing the password - raise the VPN to the server with the site and the admin panel is made available only through the VPN.

Answer 6

Do you mean certificate authentication? Issue yourself a certificate for the server, a certificate for the client, and require a certificate from your CA when connecting. A client certificate request is issued prior to any exchange, during the establishment of a secure connection. All bruter-injectors will fall off like dead cockroaches :)

Answer 7

Block by IP, write to the IP database of each visitor, if he visits often, let's say three times a minute, then we block.