What it is
Admin panels reachable from any IP are the target of constant credential-stuffing and password-spray attacks. Attackers scan the internet for known admin URL patterns (/wp-admin/, /admin/login/, /phpmyadmin/, /gitlab/users/sign_in), then test stolen credentials against them at scale. A single reused password grants full administrative control.
Why it matters
Admin access is the shortest path to full compromise. From a CMS admin panel, an attacker can plant persistent backdoors, exfiltrate customer data via the built-in export, and pivot to connected identity providers via OAuth applications configured in the admin. From a database admin panel, they get straight to the raw data.
The check behind the finding
curl -sI https://yourfirm.ca/wp-admin/If a login page loads from any network, the panel is open to the internet.
Closing it
This can be closed without taking the panel away from the people who need it. The assessment lists each page that answers from the public internet and gives the exact steps.