My personal thoughts on the ThinkPHP Admin module, I don't know if it's right or not

My ThinkPHP version is 3.2.3
Currently, the ways to open the backend are
domain name/admin/login and domain name/admin.php/login
And I am wondering if only one of them should be specified. The address can be accessed to the backend
I think it is this address: domain name/admin.php/login
Cancel: domain name/admin/login
I checked the manual and the module is prohibited from accessing here

<code>// 设置禁止访问的模块列表
 'MODULE_DENY_LIST'      =>  array('Common','Runtime','Admin'),</code>

In this case, I can only use the domain name /admin.php/login to access the backend
I don’t know if my idea is correct or if it is redundant
I am still thinking about whether to give the admin module another name Don’t let others know your name (or accidentally) enter the background...

Reply content:

My ThinkPHP version is 3.2.3
Currently, the ways to open the backend are
domain name/admin/login and domain name/admin.php/login
And I am wondering if only one of them should be specified. The address can be accessed to the backend
I think it is this address: domain name/admin.php/login
Cancel: domain name/admin/login
I checked the manual and the module is prohibited from accessing here

<code>// 设置禁止访问的模块列表
 'MODULE_DENY_LIST'      =>  array('Common','Runtime','Admin'),</code>

In this case, I can only use the domain name /admin.php/login to access the backend
I don’t know if my idea is correct or if it is redundant
I am still thinking about whether to give the admin module another name Don’t let others know your name (or accidentally) enter the background...

You need to use bind_module after disabling access to the module. Check the manual for instructions

I just tried the MODULE_DENY_LIST field. After setting it, the module cannot be accessed in any way, so it is not the effect you want. There is no way to remove it yet.
If you want to give the admin module a name that others don’t know, you just need to name it XXXXX.php and write define('BIND_MODULE','Admin'); in it

I think it doesn’t matter, the key point is not to call admin directly, just choose a name that others will never guess

Actually, they are two different applications. You can directly get a domain name to access them. Safer

The correct way to block others’ access is: physical isolation, usage permission control, etc.

[Change it to a name that others can’t guess] This is a mistake for primary school students, don’t do it.