I'm working on a site that, in production, will have no logins. We've gone with Drupal to facilitate the creating and editing of content by non-experts.

My question is, in this scenario, what's the best practice for allowing an administrator to log in? Since there no login on the main site, how does an admin access it?

I know there's the standard page mysite.com/user or mysite.com/user/login. Leaving that out there where knowledgeable users could find it seems less than ideal to me.

Is that how people do it? Or is there another way?

  • What are you asking here? There is always going to be Drupal's superuser/root uid 1 user...
    – Jimajamma
    Commented Mar 4, 2014 at 17:57
  • Sorry if I was unclear Jimajamma. jdu's answer addressed my concerns.
    – Dan Barron
    Commented Mar 4, 2014 at 18:38

1 Answer 1


Those pages are, by default, blocked in the Drupal generated robots.txt file meaning that it's very unlikely a "regular user" will stumble on them.

Someone would have to know you were using Drupal, and then type in that URL. You're right though: many people will know how to do that.

However, it's not a big deal. Your admin account password should be strong enough that it cannot be guessed at. Drupal is quite secure. You have nothing to fear about leaving that login form where it is unless your passwords are really, really bad.

The amount of effort to re-create the login pages elsewhere does not make any sense in this case.

  • Thanks, jdu. That was the reassurance I wanted. Just that it is safe and it's how it's usually done. I couldn't find any info on the subject anywhere.
    – Dan Barron
    Commented Mar 4, 2014 at 18:38
  • 1
    Good answer. Don't worry about the "/user" URL. THe security of your Drupal site does not (and should not) depend on the obscurity of your login page. Commented Mar 4, 2014 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.