Access Key hides Joomla's administrator login behind a URL key

Joomla sites need this kind of measure because the standard /administrator path is predictable and routinely probed by automated scanners. Core covers authentication, permissions, action logging and, depending on the Joomla setup, multi-factor authentication, but it does not add a secret URL key before the administrator login. A web server or firewall can restrict access by IP, while a template override is generally not the right tool for changing an administrator request. Sites that want a response for unauthorised visitors, temporary IP-based access and failed-key lockouts usually need server configuration or an extension. According to the listing, Access Key goes beyond Joomla core by checking a query-string key, allowing a 401 message, redirect or template 404, and keeping access open for twelve hours per IP.

This is aimed at small teams, agencies and privately managed Joomla sites that want to reduce login-form exposure without restricting the administrator area to a fixed office network. The developer says it also supports IP allowlists, CIDR ranges, IPv4 and IPv6, and Joomla Action Log entries. Sites already protected by a VPN, firewall or strict reverse-proxy policy may gain little from it; ordinary public-facing sites with no concern about administrator probing have no obvious need.

Access Key is listed as a free system plugin from Joomill, for Joomla 5 and 6, with updates through Joomla's update system. The directory shows 24 other Joomill extensions, but this listing has no reviews. Check how the URL key interacts with proxies, caching, security tools and shared administrator access, and review the recovery procedure before enabling it. The key is placed in a URL, so it should be handled like a credential. The listing also has a licensing discrepancy: its description says GPL version 3 or later, while the directory metadata says GPLv2 or later.

Listed on the Joomla Extensions Directory.