Support

Admin Tools

#33955 Blocked from website admin every time my web host changes IP address

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by on Wednesday, 02 December 2020 20:17 CST

[email protected]

Hi

My web host often changes my IP address. Every time this happens I am blocked from the admin section of my websites. I understand how to use Admin Tools rescue mode and I can always regain access. But could you please suggest any settings I can change in Admin Tools to stop this blocking behaviour?

The "Allow administrator access only to IPs in Exclusive Allow IP List" is set to NO. Are there any other settings I should change to stop me from getting blocked so frequently?

Paul

nicholas
Akeeba Staff
Manager

Your web host is where your web site is hosted. I don't see a reason why your site would be changing its IP address or why that would be an issue with Admin Tools.

Most likely you mean that your ISP (Internet Service Provider), the company that connects your house/office to the Internet, is changing the IP address of your Internet connection regularly. This is normal and expected. In this case you need to go to Admin Tools, Web Application Firewall, Configure WAF and set "Allow administrator access only to IPs in Exclusive Allow IP List" to No. Please note that the documentation of this feature tells you to not enable it if you do not have a static IP address because ISPs do, indeed, change your IP address very often. Some do even on an hourly basis.

 

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

[email protected]

Hi Nicholas, thanks for your prompt reply. Yes you're quite right it's my ISP not web host that determines the IP address - my mistake. As mentioned in my post, I already have "Allow administrator access only to IPs in Exclusive Allow IP List" set to No. Is there anything else I need to change to stop this happening?

nicholas
Akeeba Staff
Manager

This is the only feature which would be triggered by just your IP changing. We can conclude that the IP change is a red herring. So let's go back to the basic troubleshooting.

First go to Admin Tools, Web Application Firewall, Configure WAF. Make sure "Log security exceptions" is set to Yes; if it's not, set it to Yes and click on Save.

Now try reproducing your issue – or, rather, wait until it happens again. At this point you'll be blocked from your site. Follow Step 1 (only Step 1, please) of these instructions. Immediately after that, please go to Admin Tools, Web Application Firewall, Blocked Requests Log. The latest log entry at the top should have the date and time of when the issue occurred. Please copy the Reason and Target URL here so that we can further help you.

After filing your reply to me follow the Step 2 of the instructions I linked to completely unblock yourself and resume Admin Tools protection on your site.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

nicholas
Akeeba Staff
Manager

This is a known issue. Here's a mitigation for now. When you try to visit the Rescue URL make sure you do not include the /administrator in it.

However, you only get to visit a rescue URL after you're already blocked. I want to know what got you clocked in the first place. That is what we need to address.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

[email protected]

There are many items in the blocked request log preceding the one above, how can we tell which one caused me to be blocked?

nicholas
Akeeba Staff
Manager

Every entry has an IP address listed. You can filter the entries matching your own IP address. If you do not know what your IP address is go to https://www.what-is-my-ipv4.com/en

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

[email protected]

I cannot find any instances of my own IP address in the Blocked Request Log. Is there anything else I can look at?

nicholas
Akeeba Staff
Manager

I have a suspicion that you used the “Unblock my IP” button instead of following my instructions. Please don't do that. That button removes all entries with your IP from the blocked requests log.

It's best if you don't use the Rescue URL or the Unblock my IP button. Just follow my instructions from last Wednesday. I have taken care to give you instructions which will preserve the information I need long enough for you to relay it to me.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

[email protected]

Here is the Reason and Target URL from one of my sites I was blocked from this morning:

Reason = Admin Query String

Target URL =

https://cornwall-holidays.info/administrator/

 

Admin Query String https://cornwall-holidays.info/administrator/

nicholas
Akeeba Staff
Manager

As you can read in our documentation about blocking reasons, the description of this blocking reason is:

Someone tried to access your site's administrator section but he didn't provide the secret URL parameter. Admin Tools blocked him and prevented him from seeing the login page at all.

So the real problem is that you are trying to access your administrator login page without using the Secret URL Parameter that you have configured in Components, Admin Tools, Web Application Firewall, Configure WAF, Basic features. Follow that link and look under “Administrator secret URL parameter” for more information about how to use this feature.

Please remember that when your IP address changes Joomla will automatically try to log you out of your site because your login session’s IP address does not match your current IP address. If at this point you are still logged into your backend and try to access a backend page – or editing an article, in which case Joomla automatically tries to access your backend every few minutes to renew your session – you will trigger this block reason. If this happens enough times, as configured in the Configure WAF page’s Auto-ban tab, your IP address will be blocked.

If you suspect this is the case you can first try to log out of your Joomla administrator area once you are done using it and not leave browser tabs to it open in the background (background tabs do try to refresh periodically and may cause this block reason to be triggered without you knowing). If this is not enough you should disable this feature by setting the Administrator Secret URL Parameter to an empty string. In fact, I recommend instead using Admin Tools’ administrator password protection feature if available on your server. This latter feature relies on your web server handling the additional authentication, before PHP (let alone Joomla and Admin Tools) has a chance to load. It better protects you against brute force attacks trying to guess your admin login information than the secret URL parameter. The only downside is that it only works on Apache and Litespeed servers which are nearly 90% of servers used out there and by far and large what commercial hosting providers use.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

System Task
system
This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!