Launching today
L7 Admin Guard
Stealth mode for your admin panels and internal tools
9 followers
Stealth mode for your admin panels and internal tools
9 followers
Bots scan every new website for admin panels within minutes of launch. L7 Admin Guard makes yours invisible - 404/NXDOMAIN to the world, instant access for your team via a 5-char token. Access expires itself. TLS stays end-to-end.
Hey Product Hunt!
L7 Admin Guard started with a defaced website. A friend's site got hit right before New Year's Eve. A stolen password, his or a contractor's, nobody could even tell. The fix was obvious: put the admin panel behind an IP whitelist. The problem was equally obvious: he's a great content creator, but VPNs and ZTNAs are not his world. I set him up with a self-hosted proxy and a browser extension. The stack any engineer would call "simple" and watched him lose the JSON config file somewhere in his Telegram history.
That's when it clicked: the config shouldn't be a file you send. It should be five characters you can read over the phone.
Once I started looking, the pattern was everywhere: everyone knows admin panels shouldn't face the public internet, but the "proper" solutions are so heavy that teams just... don't. VPNs that slow everything down, zero-trust platforms that need a DevOps hire, SSO onboarding that nobody maintains. So the wp-admin stays open, and the bots keep knocking.
L7 Admin Guard takes a different trade: maximum security people will actually use.
How it works: You close your admin panel behind an IP whitelist (or don't publish a DNS record at all). Your team installs a tiny browser extension (Chrome/Firefox), pastes a 5-character token, and the site just opens. Everything else (YouTube, Netflix,...) goes direct, never through the gateway.
What I'm most proud of:
Smart token limits: N devices, N days, N GB and the clock can start at first activation, not creation. Make a token on Friday; your freelancer burns their 3 hours on Monday. Set an activation window so unused tokens expire instead of lying dormant. No accounts to forget to delete.
Zero-trust privacy: TLS is end-to-end (SNI routing, no termination). We physically can't read your traffic.
1-click deploy for non-terminal folks: Connect your Hetzner, Vultr, DigitalOcean, Akamai, or UpCloud API key, pick a region, hit "Deploy". We spin up the server, install the gateway, and issue a wildcard Google Trust Services certificate via DNS-01 - аll in parallel. 1-2 minutes later you have a working gateway without ever touching a console.
Ultra-lightweight core: If your provider isn't on that list, it's still one command away. Аn 8 MB Go binary, zero dependencies, zero config files.
Transparent extension: Just 38 KB of vanilla JS. No minification, no obfuscation. You can audit the whole thing in an evening.
Test it live right now (no signup required):
We set up 4 live interactive demo environments right on our landing page. Grab the extension from the official store, paste the demo token from our landing page, and watch a 404 turn into a working admin panel in real-time across any of the scenarios.
I'll be here all day — ask me anything, especially the hard security questions. Those are the fun ones!