L7 Admin Guard
Stealth mode for your admin panels and internal tools
11 followers
Stealth mode for your admin panels and internal tools
11 followers
Bots scan every new website for admin panels within minutes of launch. L7 Admin Guard makes yours invisible - 404/NXDOMAIN to the world, instant access for your team via a 5-char token. Access expires itself. TLS stays end-to-end.
Hey Product Hunt!
L7 Admin Guard started with a defaced website. A friend's site got hit right before New Year's Eve. A stolen password, his or a contractor's, nobody could even tell. The fix was obvious: put the admin panel behind an IP whitelist. The problem was equally obvious: he's a great content creator, but VPNs and ZTNAs are not his world. I set him up with a self-hosted proxy and a browser extension. The stack any engineer would call "simple" and watched him lose the JSON config file somewhere in his Telegram history.
That's when it clicked: the config shouldn't be a file you send. It should be five characters you can read over the phone.
Once I started looking, the pattern was everywhere: everyone knows admin panels shouldn't face the public internet, but the "proper" solutions are so heavy that teams just... don't. VPNs that slow everything down, zero-trust platforms that need a DevOps hire, SSO onboarding that nobody maintains. So the wp-admin stays open, and the bots keep knocking.
L7 Admin Guard takes a different trade: maximum security people will actually use.
How it works: You close your admin panel behind an IP whitelist (or don't publish a DNS record at all). Your team installs a tiny browser extension (Chrome/Firefox), pastes a 5-character token, and the site just opens. Everything else (YouTube, Netflix,...) goes direct, never through the gateway.
What I'm most proud of:
Smart token limits: N devices, N days, N GB and the clock can start at first activation, not creation. Make a token on Friday; your freelancer burns their 3 hours on Monday. Set an activation window so unused tokens expire instead of lying dormant. No accounts to forget to delete.
Zero-trust privacy: TLS is end-to-end (SNI routing, no termination). We physically can't read your traffic.
1-click deploy for non-terminal folks: Connect your Hetzner, Vultr, DigitalOcean, Akamai, or UpCloud API key, pick a region, hit "Deploy". We spin up the server, install the gateway, and issue a wildcard Google Trust Services certificate via DNS-01 - аll in parallel. 1-2 minutes later you have a working gateway without ever touching a console.
Ultra-lightweight core: If your provider isn't on that list, it's still one command away. Аn 8 MB Go binary, zero dependencies, zero config files.
Transparent extension: Just 38 KB of vanilla JS. No minification, no obfuscation. You can audit the whole thing in an evening.
Test it live right now (no signup required):
We set up 4 live interactive demo environments right on our landing page. Grab the extension from the official store, paste the demo token from our landing page, and watch a 404 turn into a working admin panel in real-time across any of the scenarios.
I'll be here all day — ask me anything, especially the hard security questions. Those are the fun ones!