# Security Issue - hiding login portal with custom domain whilst keeping custom domain for links **URL:** \ **Category:** Product Support\ **Created:** [February 27, 2020, 10:14am UTC](https://forum.mautic.org/t/security-issue-hiding-login-portal-with-custom-domain-whilst-keeping-custom-domain-for-links/13124 "2020-02-27T10:14:39Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![PrimRose](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/primrose/32/1783_2.png) [@PrimRose](https://forum.mautic.org/u/PrimRose)\ **Post date:** [February 27, 2020, 10:14am UTC](https://forum.mautic.org/t/security-issue-hiding-login-portal-with-custom-domain-whilst-keeping-custom-domain-for-links/13124/1 "2020-02-27T10:14:39Z")
**Your software** My Mautic version is: 2.16.0 My PHP version is: 7.1.32-1+0~20190902.23+debian9~1.gbp9d1be7 **Your problem** My problem is: I posted this before and it seems to have disappeared. When I use a custom domain for mautic, let’s say [m.demo.com](http://m.demo.com) when you go there you get the login portal for Mautic. Issue is I want custom domains for my links but what to stop people accessing the login portal by cutting the link down. For example client clicks link and goes to [m.demo.com/84€3929](http://m.demo.com/84%E2%82%AC3929) all hunky dory. But a client curting it off goes to [m.demo.com/](http://m.demo.com/) then sees my mautic portal, not my site. I really need a solution on this. Cant have the login portal open to all an sundry! These errors are showing in the log: None Steps I have tried to fix the problem: Not sure how to do this. Hence the question. Thanks team Prim ---
**Author:** ![silavapi](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/silavapi/32/7424_2.png) [@silavapi](https://forum.mautic.org/u/silavapi)\ **Post date:** [February 27, 2020, 10:33am UTC](https://forum.mautic.org/t/security-issue-hiding-login-portal-with-custom-domain-whilst-keeping-custom-domain-for-links/13124/2 "2020-02-27T10:33:08Z")
Hi there, Take a look at this setting in your config: ![screenshot-local.mautictest-2020.02.27-10_32_24](https://us1.discourse-cdn.com/flex020/uploads/mautic/original/2X/9/9a95f8d31e7eecd7a816306c0234398d038750a7.png) ---
**Author:** ![robm](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/robm/32/260_2.png) [@robm](https://forum.mautic.org/u/robm)\ **Post date:** [February 26, 2023, 2:53pm UTC](https://forum.mautic.org/t/security-issue-hiding-login-portal-with-custom-domain-whilst-keeping-custom-domain-for-links/13124/3 "2023-02-26T14:53:16Z")
If you change the mautic’s root url, how does one then access the mautic login page? After being brute force hacked I would like to have my login page not be easily found by simply inspecting the website its linked to and seeing the tracking pixel with url plain to see. @ekke is this blog still valid? > **[Security Tip: Redirect Mautic Homepage to external URL](https://www.leuchtfeuer.com/en/mautic-know-how/mautic/redirect-mautic-homepage-to-external-url/)** > > People love to poke around. For instance, see the URL of a Mautic asset and try to access the root page of that domain. What do they see? The Mautic login screen. Not good! > Best practice is to redirect that access to some other URL, e.g. your main... ---
**Author:** ![robm](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/robm/32/260_2.png) [@robm](https://forum.mautic.org/u/robm)\ **Post date:** [February 26, 2023, 2:57pm UTC](https://forum.mautic.org/t/security-issue-hiding-login-portal-with-custom-domain-whilst-keeping-custom-domain-for-links/13124/4 "2023-02-26T14:57:45Z")
> [@robm](#): > > [https://www.leuchtfeuer.com/en/mautic-know-how/mautic/redirect-mautic-homepage-to-external-url/](https://www.leuchtfeuer.com/en/mautic-know-how/mautic/redirect-mautic-homepage-to-external-url/) May have answered my own question. Simple add “/s” to your original mautic login page url to access the login page. Not that secure but more secure than not changing the base url ---
**Author:** ![tonyr](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/tonyr/32/9283_2.png) [@tonyr](https://forum.mautic.org/u/tonyr)\ **Post date:** [February 26, 2023, 9:29pm UTC](https://forum.mautic.org/t/security-issue-hiding-login-portal-with-custom-domain-whilst-keeping-custom-domain-for-links/13124/5 "2023-02-26T21:29:16Z")
Is it possible to offload the front end to something like Cloudflare? We do this and limit the source addresses to Cloudflare’s range. Essentially that means Cloudflare can handle any brute force stuff and our own server IP’s are hidden as DNS will show cloudflare. ---
**Author:** ![silavapi](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/silavapi/32/7424_2.png) [@silavapi](https://forum.mautic.org/u/silavapi)\ **Post date:** [February 27, 2023, 7:22am UTC](https://forum.mautic.org/t/security-issue-hiding-login-portal-with-custom-domain-whilst-keeping-custom-domain-for-links/13124/6 "2023-02-27T07:22:13Z")
Yes, you can use Cloudflare but you’ll need you ensure that the original IP is forwarded through. There are a few posts about it on the forums.