I find it amusing here that noone mentioned that this guy linked to Obama’s Admin login panel??? Strange. Something like is usually private. 😊
I linked to the admin login panel because it clearly says “Blue State Digital” on the banner. Anyone who knows the CMS also knows the paths for the admin and login pages. For example the Drupal login page /user/login and the admin page /admin are also well known. As long as the passwords are strong and the CMS is well designed you shouldn’t need to make these pages private; it will only inconvenience authorized users.
Why should it be private and what exactly do you mean by private? Are you suggesting security through obscurity like changing the path from the default? Or are you suggesting adding http auth on top of the CMS authentication? (A single strong password is just as good as two strong ones and better than two weak ones) Or are you suggesting whitelisting the IPs of Obama’s headquarters and the administrator’s home static IPs? (Which also prevents authorized from connecting from most remote locations) The last one being the only suggestion which adds any real protection.