# Ghost Admin Security: Is there any way to redirect Admin-URL (Redirection Alternative)

**URL:** <https://forum.ghost.org/t/ghost-admin-security-is-there-any-way-to-redirect-admin-url-redirection-alternative/21939>\
**Category:** Installation\
**Created:** [April 16, 2021, 2:41am UTC](https://forum.ghost.org/t/ghost-admin-security-is-there-any-way-to-redirect-admin-url-redirection-alternative/21939 "2021-04-16T02:41:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![georgie](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@georgie](https://forum.ghost.org/u/georgie)\
**Post date:** [April 16, 2021, 2:41am UTC](https://forum.ghost.org/t/ghost-admin-security-is-there-any-way-to-redirect-admin-url-redirection-alternative/21939/1 "2021-04-16T02:41:27Z")

</div>

Hello Ghosters and Dev. Team,

I am currently using the latest update version of Ghost v4 (self-hosted)

I want to ask if is there any way or alternative solution to secure and hide or redirect our admin URL? Since most of the people who know about Ghost, for sure, know exactly what the admin URL Path is, **[domain.com/ghost](http://domain.com/ghost)**, anyone can enter that path easily. My concern is security reasons.

Thank you.

---

<div class="post-metadata">

**Author:** ![vikaspotluri123](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/vikaspotluri123/32/24_2.png) [@vikaspotluri123](https://forum.ghost.org/u/vikaspotluri123)\
**Post date:** [April 16, 2021, 2:53am UTC](https://forum.ghost.org/t/ghost-admin-security-is-there-any-way-to-redirect-admin-url-redirection-alternative/21939/2 "2021-04-16T02:53:00Z")

</div>

This was asked in the past, and the answer is kind-of, and there’s even some suggestions in the thread 🙂

> [@Configurable Admin URL](https://forum.ghost.org/t/configurable-admin-url/7984):
>
> Hello, I’ve started using Ghost after testing and evaluating a lot of other CMS’s. I am very happy with my choice. For that reason I would have put a “Powered by Ghost” linking to [ghost.org](http://ghost.org) in the footer, if this was not telling the world where you can login to the admin pages. I know there are several options to harden a ghost instance. However, I appreciate every bit of extra security. So I would like to have the possibility to configure the relative URL of the admin pages. thx Johan

Additionally, you can also require another layer of authentication using something like [Cloudflare Access](https://www.cloudflare.com/teams/access/) or [subrequest authentication](https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-subrequest-authentication/))

---

<div class="post-metadata">

**Author:** ![georgie](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@georgie](https://forum.ghost.org/u/georgie)\
**Post date:** [April 16, 2021, 3:00am UTC](https://forum.ghost.org/t/ghost-admin-security-is-there-any-way-to-redirect-admin-url-redirection-alternative/21939/3 "2021-04-16T03:00:27Z")

</div>

Hello @vikaspotluri123 , thank you for answering my question,

Yeah, I just remember that we can set rule access on Cloudflare as well for this.

For this moment, instead of configure the URL, the best option only to layer this. Hoping that Dev. team can do something for any future updates for this. Since I really love this Ghost CMS.

Thank you so much for your kind attention to help @vikaspotluri123 . Have a great day!

---

<div class="post-metadata">

**Author:** ![Kevin](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/kevin/32/32_2.png) [@Kevin](https://forum.ghost.org/u/Kevin)\
**Post date:** [April 16, 2021, 6:40am UTC](https://forum.ghost.org/t/ghost-admin-security-is-there-any-way-to-redirect-admin-url-redirection-alternative/21939/4 "2021-04-16T06:40:00Z")

</div>

You can’t change the `/ghost/` part but it’s possible to “hide” the admin using config.

```auto
{
    "url": "https://mysite.com/",
    "adminUrl": "https://secret.mysite.com/",
    "admin": {
        "redirects": false
    }
}

```

Your admin then lives at `https://secret.mysite.com/ghost/` and `https://mysite.com/ghost/` will 404 rather than redirect. However, if you are using the Content API via JS then your admin url will still be exposed because it’s where Ghost’s API lives.

None of this really changes the security of your site, Ghost is already secure, all it would be doing is obscuring things slightly. As @vikaspotluri123 said, if you want extra security you can place additional authentication mechanisms on top of your admin endpoints but it’s worth remembering that will also limit access for integrations which will typically not be built to handle any additional auth.

---

<div class="post-metadata">

**Author:** ![thebear.dev](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/thebear.dev/32/13956_2.png) [@thebear.dev](https://forum.ghost.org/u/thebear.dev)\
**Post date:** [April 20, 2021, 8:52am UTC](https://forum.ghost.org/t/ghost-admin-security-is-there-any-way-to-redirect-admin-url-redirection-alternative/21939/5 "2021-04-20T08:52:48Z")

</div>

Hi Kevin,

If you don’t mind me asking, what config file are we talking about? I tried the above on a local install and on my production and `http://localhost:2369/ghost` and `https://example.com/ghost/` still worked even after a restart adding the below to `config.development.json`

```auto
{
  "url": "http://localhost:2369/",
  "adminUrl": "http://secret.localhost:2369/",
  "admin": {
      "redirects": false
  },
  "server": {
    "port": 2369,
    "host": "127.0.0.1"
  
  },

```