WireGuard for Web Service Administration

Why Hide Web Administration?

WordPress. ISPConfig. phpMyAdmin. Webmin. Every web service ships with an administration interface — and every administration interface is a target. Login pages for CMS platforms, hosting control panels, and database tools are discovered by automated scanners within minutes of deployment. From there: brute-force attempts, credential-stuffing attacks, and exploit attempts against known vulnerabilities.

The traditional defence is a username and password. Strong credentials, two-factor authentication, IP allowlisting — all layers on top of a surface that shouldn't be visible in the first place. Every additional layer is another thing to configure, monitor, and maintain. And every layer can be misconfigured.

WireGuard removes the surface entirely. Administrative interfaces for web services are not exposed to the public internet. They are not behind a login page. They are not protected by a password. They simply do not exist to anyone outside the WireGuard mesh. You cannot attack what you cannot see.

What Gets Hidden

Hosting Control Panels

ISPConfig, cPanel, Plesk, or any hosting control panel is the most powerful interface on a web server. It controls domains, databases, email accounts, and file permissions. Exposing it to the internet — even behind a strong password — is unnecessary risk. Behind WireGuard, it is accessible only to the people who need it, on the devices they've configured as trusted peers.

Content Management Systems

WordPress handles approximately 43% of all websites — and its /wp-admin login page is the most-probed URL on the internet. Automated attacks attempt default credentials, known vulnerable plugin versions, and XML-RPC exploits continuously. Moving /wp-admin behind WireGuard means the WordPress application still serves public pages normally — visitors see the website exactly as intended — but the login and administration functions are unreachable from the internet. Staff log in through the tunnel.

Database Administration

phpMyAdmin, Adminer, and pgAdmin provide full database access through a web browser. A compromised database admin interface means complete data exfiltration. These tools should never face the public internet. Behind WireGuard, they are available to administrators without ever appearing on a port scan.

Security Dashboards

Wazuh, Grafana, netdata, and monitoring dashboards display sensitive infrastructure information — server health, security events, user activity, network topology. This is reconnaissance gold for an attacker. Behind WireGuard, these dashboards serve their purpose for the operations team without publishing operational intelligence to the world.

What Stays Public

This is not about hiding your website. Public content — your firm's homepage, practice area pages, contact forms, client portals — continues to be served normally through the edge proxy. TLS certificates are valid. Visitors see your site. Search engines index it. The only difference is that the administration surface has been removed from public reach.

Real-World Example

Kimpton Lawyers' public website runs on HAProxy with ModSecurity WAF at the edge. TLS is terminated at the proxy. The WordPress backend, ISPConfig panel, and phpMyAdmin are bound to internal addresses on the web server. An administrator connecting from home opens their WireGuard client — which authenticates with a cryptographic keypair, not a password — and accesses the admin panel at its internal IP. To the internet, those ports do not exist. Server logs show zero authentication attempts against the admin interfaces, because there is no interface to attempt.

Comparison With Traditional Approaches