I'm working on a site that, in production, will have no logins. We've gone with Drupal to facilitate the creating and editing of content by non-experts.

My question is, in this scenario, what's the best practice for allowing an administrator to log in? Since there no login on the main site, how does an admin access it?

I know there's the standard page mysite.com/user or mysite.com/user/login. Leaving that out there where knowledgeable users could find it seems less than ideal to me.

Is that how people do it? Or is there another way?

  • What are you asking here? There is always going to be Drupal's superuser/root uid 1 user... – Jimajamma Mar 4 '14 at 17:57
  • Sorry if I was unclear Jimajamma. jdu's answer addressed my concerns. – Dan Barron Mar 4 '14 at 18:38

Those pages are, by default, blocked in the Drupal generated robots.txt file meaning that it's very unlikely a "regular user" will stumble on them.

Someone would have to know you were using Drupal, and then type in that URL. You're right though: many people will know how to do that.

However, it's not a big deal. Your admin account password should be strong enough that it cannot be guessed at. Drupal is quite secure. You have nothing to fear about leaving that login form where it is unless your passwords are really, really bad.

The amount of effort to re-create the login pages elsewhere does not make any sense in this case.

  • Thanks, jdu. That was the reassurance I wanted. Just that it is safe and it's how it's usually done. I couldn't find any info on the subject anywhere. – Dan Barron Mar 4 '14 at 18:38
  • 1
    Good answer. Don't worry about the "/user" URL. THe security of your Drupal site does not (and should not) depend on the obscurity of your login page. – marcvangend Mar 4 '14 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.