Admin Restriction (IP Whitelist + 2FA)

vendic/magento2-adminrestriction

Restricts Magento backend access by IP address or CIDR range and integrates with Magento's two-factor authentication, letting whitelisted IPs skip 2FA while others are challenged. Includes CLI commands for emergency access recovery.

Installs cleanlyPHPStan level 1Build passingsilver partnerSemVer violations (90% compliant)

Supported Magento versions: 2.4.9

4,263 installs★ 2 starsLatest: v2.1.1Released 2025-04-11License: OSL 3.0

composer require vendic/magento2-adminrestriction

README

Reproduced from the package’s own README, under its own license, as of 2026-09-13. Links and images point back at the source repository.

Magento 2 Admin Restriction

Protect your Magento backend by restricting access based on IP addresses.

This module provides comprehensive admin security by working with Magento's Two-Factor Authentication (2FA) system:

  • Without 2FA enabled: Access is only allowed from whitelisted IPs
  • With 2FA enabled:
    • Users on whitelisted IPs can login without using 2FA
    • Users from non-whitelisted IPs are prompted for 2FA verification

Originally forked from magespecialist/m2-MSP_AdminRestriction

Why this fork?

This fork is maintained by Vendic to:

  1. Add compatibility with Magento's Two-Factor Authentication
  2. Provide ongoing maintenance and updates
  3. Ensure the module continues to work with recent Magento 2 versions

Installation

1. Install using composer

composer require vendic/magento2-adminrestriction

2. Enable and configure from your Magento backend config

Configuration

The module allows you to:

  • Enable/disable IP restrictions
  • Define a comma-separated list of allowed IPs or CIDR notations (e.g., 127.0.0.1,192.168.0.0/24)

Two-Factor Authentication Integration

This module intelligently integrates with Magento's 2FA capabilities:

IP Status 2FA Status Behavior
On whitelist 2FA disabled Access granted
On whitelist 2FA enabled Access granted without 2FA prompt
Not on whitelist 2FA disabled Access denied
Not on whitelist 2FA enabled 2FA verification required

Emergency Command Line Access

If you've accidentally locked yourself out of the admin panel, you can use these commands:

Disable IP restrictions completely:

php bin/magento msp:security:admin_restriction:ip disable

Add new IP addresses to the whitelist:

php bin/magento msp:security:admin_restriction:ip 127.0.0.1,192.168.0.0/24

Maintenance

This module is actively maintained by Vendic. Issues and pull requests are welcome on our GitHub repository.

Links

More from vendic

  • Optimize Cache Size

    Reduces cache keys by removing product/category specific layout handles. Improves performance by decreasing cache size and average Redis TTL.

  • Google Address Autocomplete

    Adds Google Autocomplete to customer street address fields. Improves address entry and accuracy during checkout.

  • Clean Cron Schedule

    Automatically removes stale rows from the cron_schedule table once a day, preventing it from growing huge and causing slow cron runs and heavy CPU usage.

Similar modules

  • Codemirror

    Integrates the CodeMirror code editor into Magento 2 admin. Provides form elements for UI components and frontend models for system configuration.

  • Clean Admin Menu

    Consolidates third-party extension menus into a single "Extensions" menu. Organizes extension configurations under a unified tab in Stores > Configuration.

  • Hyvä Admin

    This module aims to make creating grids and forms in the Magento 2 adminhtml area joyful and fast, without usage of UI components.

← All packages from vendic