A site that I built last autumn had the CP url set as system/index.php (I think I was following Ryan Irelan’s advice in that regard). It works fine. However, last night I did a quick install of EE Core and the bit of the installation wizard specifying ‘URL to your control panel access file’ pre-filled itself with admin.php. Either method seems to work (provided I appropriately specify the $config['cp_url'] parameter in my config.php file) but I am left wondering which is the ‘correct’ way? mydomain.com/system/index.php or my domain.com/admin.php? And is one way more secure than the other?


It's not that using admin.php is a security benefit in itself, it's that it allows you to move your entire /system folder outside of the web root. If you don't take that step then you will see no benefits whatsoever. In fact, if you leave both admin.php and /system in your public_html folder (or equivalent) that's arguably detrimental to security, as you've got two separate CP logins for people to stumble across rather than one.

Why move your system folder out of the web root?

It's a bit like living in an underground bunker rather than a normal house. Instead of having a ton of doors and windows for someone to throw a rock through you've just got the one. If there's an XSS exploit for system/expressionengine/third_party/dodgy_addon/mcp.dodgy_addon.php you aren't vulnerable to it as that file isn't publicly accessible. Any successful hack has to be routed through admin.php*.

Should I always move the system folder out of the web root?

Ideally yes, but you won't always have a choice over server environments or deployment practices, and sometimes it might not be feasible. So long as /system has been renamed it probably isn't worth losing sleep over, but if you have the option it's always worth doing.

* Short of server-level exploits which are really a separate issue.

  • Good points, Dom, thanks. I'm currently establishing a portable config.php/database.php setup for easy pre-configured rollouts, and for the time being I'm going to do that with the assumption that I won’t have the option of moving directories above webroot, but will definitely do so where the opportunity presents itself -- in which case admin.php will evidently come into its own. In either case I’ll probably leave admin.php in place as per Alex Roper’s reasoning (see below). – RickL Feb 25 '13 at 13:12
  • I can't see why you'd be concerned about your system folder's URL appearing in your own request logs. They're your logs on your server and they shouldn't be publicly accessible. Referer headers are a slight concern but EE (and any smart addons) route external requests through index.php?URL=X, as Alex points out. – Dom Stubbs Feb 25 '13 at 15:22

I believe the main and immediate advantage to using admin.php, wether you move the system folder above root or not, is that it hides the name of the system directory from http request logs. So if you have renamed your system folder (for security reasons), your browser is only making requests to admin.php, not secret_system_folder/index.php.

It's the same reason why when you click the name of your site in the upper right corner of the control panel, you're taken to http://example.com/index.php?URL=http://example.com. I believe this is to mask the referrer URL in server logs from recording your system folder.


You need to use admin.php when using MSM (Multi Site Manager). The system folder is only present in one of the sites so if you want to access the Control Panel from one of the other sites you have to use admin.php.

First site in MSM looks like:


Each subsequent site just has:


You can access the Control Panel for any site in the MSM from the master (for want of a better term) site via /system/index.php, in which case you don't need admin.php, but if you limit user's access to just one, or rather not all, sites then you will need to provide admin.php as the entry point to the control panel for each site.

EE Security is what you make it - /system/index.php can be secured simply by dropping in an .htaccess file and restricting by IP or something similar. We tend to have our control panels only accessible from within our network and we can achieve this using either file. We also remove everything but the front controller (index.php/admin.php) and static assets from the public web root - but that's the answer to another question :)

  • I’ve yet to use the MSM, Jon, but that's really useful info to know in case I ever use it in the future – thanks. – RickL Feb 25 '13 at 13:05

It depends on your needs. First, when changing the name of your system folder, also change the name of the admin.php file, if you plan to use. If not, delete the admin.php file.

Our go to set-up for ExpressionEngine installs are to move the system folder out of the 'public_html' folder (aka: html, www, public, etc.) So if your set-up is more like

   - admin.php

Then you want the admin.php file.

We do have old set-ups where /system is in the public_html folder. In those cases we:

  1. Remove 'admin.php' if all control panel users are client's staff. If everyone with control panel access is also considered a trusted source (staff), then we delete the 'admin.php' file, but…

  2. Establish Multiple Levels of Trust with 'admin.php'. In these cases, we may provide only sysadmins or designated staff access to the full system folder and provided everyone else access via the admin.php file. Users of the admin.php file, generally wouldn't have ssh or ftp access either, so they NEVER know the name of the system folder.

Our biggest use though is for using admin.php when the system folder no longer has public access. A good security measure, if you can do it.

  • Thanks for the input nonprofit_tech, especially the tip about renaming the admin file – I didn’t realise that one could do that. I have a question though: re. your ‘scenario 2’ above, what benefit do you get from routing trusted staff direct to the system/index.php file rather than to the admin.php file, given that the latter is still available? – RickL Feb 25 '13 at 13:24
  • No additional benefit for the 'trusted staff'. We typically provide both urls to them and let them decide, since they know the system folder name. The benefit is more for staff or others 'without' server permissions, so that they never know the system folder name. You can't control, who on staff may give someone the ftp account to make their life easier. But, generally, we prefer the system folder to just NOT be in the public_html, so everyone uses the admin.php file. You could do the same in all scenarios. – nonprofit_tech Feb 25 '13 at 13:41
  • Yes, fair enough. (I had wondered why you didn't get even the trusted staff to use the admin.php, but it sounds like it's simply a case of “since they know the system folder name we can't stop them”). In an ideal world I'll be moving the system folder above webroot as well, but recent install scenarios haven't allowed me to do that. – RickL Feb 25 '13 at 17:00

I personally never use admin.php. I delete it from installs altogether if I do not move system folder above web root. I do not use it with MSM installs either. The only ones I have got only allow for access via the "main" domain.

One less thing to worry about ;o)


That being said, here is a great ebook on securing ExpressionEngine by Mark Huot. Well worth the money/read. If possible, moving your system folder above web root is more secure, as others have indicated.

  • I didn't even know that that was permissible Jérôme! And having less things to fuss over is always cool. But after reading the answers below, I think I might stick with the admin route. Be interested to get your take on those extra opinions though. – RickL Feb 25 '13 at 13:27
  • Well, as others have said, admin.php is useful when moving system folder above webroot (not always available as a possibility, though). Full ebook on securing EE installs by mark Huot here. Well worth the read/money. As far as MSM sites go, on my install, you can only access the CP via the master domain so no need for it here for me. Whatever you do, rename both the system folder and the admin.php file – Jérôme Coupé Feb 25 '13 at 13:35
  • Cool, didn't know deleting it was an option. Always has confused the hell out of me this file :) – erwinheiser Feb 26 '13 at 12:31

I like to have as little in the webroot as is humanly possible.

So i always have the system folder above webroot, and i always rename the admin.php file to something random that obviously the client will have to know as it is their only route in to the admin area.

Of course, those things aside, it is equally as important to make sure that you only use third party add-ons from trusted developers as a poorly written add-on will make all your hard work for nothing if someone can just attack you via the front controller anyway by exploiting a bad add-on.

As well as that, make sure your file permissions are locked down, your php version is kept up to date (i don't mean use php 5.5 or whatever, but just the latest php 5.3.x at the moment) and your server is locked down with a firewall if possible. These things will offer greater protection from nefarious types than just moving and renaming your system folder.

  • Good advice. Cheers John. – RickL Feb 26 '13 at 10:55
  • Well, someone doesn't think so, they've given this answer a minus score! – JohnWBaxter Feb 26 '13 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.