# Disable /u/admin-login
**URL:** https://meta.discourse.org/t/disable-u-admin-login/299344
**Category:** Support
**Tags:** login
**Created:** [March 14, 2024, 1:44pm UTC](https://meta.discourse.org/t/disable-u-admin-login/299344 "2024-03-14T13:44:20Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Hyan](https://meta.discourse.org/u/Hyan)
#### Post date: [March 14, 2024, 1:44pm UTC](https://meta.discourse.org/t/disable-u-admin-login/299344/1 "2024-03-14T13:44:20Z")
Hi discourse,
This question maybe asked, but I cannot find answer with keywords ‘admin-login’. My question is how can I disable user access for example, [https://forums.example.com/u/admin-login](https://forums.example.com/u/admin-login)?
---
### Author:  [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [March 14, 2024, 1:45pm UTC](https://meta.discourse.org/t/disable-u-admin-login/299344/2 "2024-03-14T13:45:46Z")
So why would you want to disable admin access?
---
### Author:  [@ondrej](https://meta.discourse.org/u/ondrej)
#### Post date: [March 14, 2024, 2:03pm UTC](https://meta.discourse.org/t/disable-u-admin-login/299344/3 "2024-03-14T14:03:08Z")
⬆ exactly that.
If you ever get ‘locked out’ by read only mode or a misbehaving sso the admin login comes in quite handy 😉
---
### Author:  [@Hyan](https://meta.discourse.org/u/Hyan)
#### Post date: [March 14, 2024, 3:35pm UTC](https://meta.discourse.org/t/disable-u-admin-login/299344/4 "2024-03-14T15:35:16Z")
Initially I have set [user@example.com](mailto:user@example.com) as admin. Then I have basic\_auth connected. So I want to myself login only through basic\_auth. So do for end users. This is a risk exposure if use access [https://forums.example.com/u/admin-login](https://forums.example.com/u/admin-login).
---
### Author:  [@Firepup650](https://meta.discourse.org/u/Firepup650)
#### Post date: [March 14, 2024, 4:28pm UTC](https://meta.discourse.org/t/disable-u-admin-login/299344/5 "2024-03-14T16:28:43Z")
> [@Hyan](#):
>
> This is a risk exposure if use access
How so? Only forum admins can use that login.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [March 14, 2024, 4:41pm UTC](https://meta.discourse.org/t/disable-u-admin-login/299344/6 "2024-03-14T16:41:48Z")
If you want increased security you can add a 2nd factor.
Are you also going to remove the forgot-password path? It has exactly the same security risk as the `/u/login`.
You could disable `/u/admin-login` with a plugin, which in the past 10 years, no one has wanted to have developed.
---
### Author:  [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [March 14, 2024, 5:12pm UTC](https://meta.discourse.org/t/disable-u-admin-login/299344/7 "2024-03-14T17:12:43Z")
> [@pfaffman](#):
>
> add a 2nd factor.
this is the way.
---
### Author:  [@Bas](https://meta.discourse.org/u/Bas)
#### Post date: [March 15, 2024, 8:56am UTC](https://meta.discourse.org/t/disable-u-admin-login/299344/8 "2024-03-15T08:56:11Z")
> [@pfaffman](#):
>
> You could disable `/u/admin-login` with a plugin, which in the past 10 years, no one has wanted to have developed.
If you are self-hosting, you could also block the route in nginx etc.
Not recommended, but possible
---
### Author:  [@Hyan](https://meta.discourse.org/u/Hyan)
#### Post date: [March 20, 2024, 7:55am UTC](https://meta.discourse.org/t/disable-u-admin-login/299344/9 "2024-03-20T07:55:41Z")
Thank you all has replied the questions. My fault I thought the discourse has option to redirect the access
of /u/admin-login to its homepage. It turns out it because I’m in logged-in state, in which users are redirected.
Totally agreed `/u/login` is risky if admin-login is. 😅
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [March 20, 2024, 4:27pm UTC](https://meta.discourse.org/t/disable-u-admin-login/299344/10 "2024-03-20T16:27:26Z")
> [@Hyan](#):
>
> I thought the discourse has option to redirect the access
> of /u/admin-login to its homepage. It turns out it because I’m in logged-in state, in which users are redirected.
HA! Yes. That can be confusing. It’s not a magic just-login-whoever-uses-that-url link!
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [April 19, 2024, 4:27pm UTC](https://meta.discourse.org/t/disable-u-admin-login/299344/11 "2024-04-19T16:27:26Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.