Internal · staff only
Store dashboard
A pretend back-office. In the real world this path holds the keys to the shop, which is why "lock /admin down to known locations" is one of the most common WAF asks.
312
Orders this week
$8,140
Revenue
27
Low-stock titles
5
Pending reviews
Recent orders
#10293
The Left Hand of Darkness · $14
#10294
Piranesi · $16
#10295
Stoner · $13
Classic rule: challenge or block requests to
/admin when the country is not your own, and allowlist your office IP with a Skip rule placed above it. Test by visiting /admin after deploying and watching Security Events.