Move or protect the Django admin URL

tech-django-admin

Django's admin sits at the default /admin/ path, so every bot knows where to aim its password guesses. Move it and rate limit what is left.

Why this matters

Django's admin panel is accessible. It requires authentication, but its presence reveals the framework and gives attackers a known login target.

Your stack

Web servers

Nginx

Django

nginx

location /admin/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://django_upstream;
}

python

# urls.py: change admin path
from django.contrib import admin

urlpatterns = [
    path('my-secret-admin-path/', admin.site.urls),
]

Does your app still have this?