README

Restricts access to the Magento 2 admin panel to selected IP addresses/ranges. A request to /admin from an address outside the allowlist gets 403 Forbidden — the rest of the store (storefront) works normally. A simple, effective layer: even if someone learns the admin login and password, without the right IP they cannot reach the panel.

Part of the MageSpecialist Security Suite. This is a maintained fork of the abandoned msp/adminrestriction (last release 2022). Even the latest Packagist version declares php ^8.1.0 — it does not run on PHP 8.4. This fork loosens the dependencies and is verified on Magento 2.4.9 / PHP 8.4 (di:compile + a real test: enable the allowlist → 403 from a disallowed IP → disable → access).

Safe default state

After installation the module is disabled (enabled = 0) — installing it will not lock you out of the panel. You enable it deliberately, once you have supplied the allowed IPs. (Verified: it does not enforce by default.)

Compatibility

• Magento 2.4.4 – 2.4.9 (Open Source / Adobe Commerce)
• PHP 8.1 – 8.4
• Requires sisl-source/magento2-security-suite-common (our fork — pulled in automatically)

Installation

composer require sisl-source/magento2-admin-restriction
bin/magento module:enable MSP_SecuritySuiteCommon MSP_AdminRestriction
bin/magento setup:upgrade
bin/magento setup:di:compile   # production mode

Configuration

CLI (fastest):

# Allow only selected IPs/ranges (enables protection):
bin/magento msp:security:admin_restriction:ip "1.2.3.4,10.0.0.0/24"
# Disable protection:
bin/magento msp:security:admin_restriction:ip disable

Admin: Stores → Configuration → MSP Security Suite → Admin Restriction — enable and enter the allowed ranges (one per line / comma-separated, CIDR supported).

Note: set the allowlist to your public IP before enabling. If you are on a dynamic IP, add your provider's whole range or use a VPN with a fixed address. If you lock yourself out — bin/magento msp:security:admin_restriction:ip disable from the server restores access.

How it works

Plugin\AppInterfacePlugin::aroundLaunch checks on every request whether it targets the admin panel and whether the client IP is in the allowlist; if not — LockDown returns 403. The storefront is untouched.

License

OSL-3.0 (same as upstream). Fork maintained by SISL.

Maintained by SISL

Maintained fork by SISL — Magento 2 development and modules. More self-hosted plugins: SISL Marketplace.