Orchard Core CMS Tutorials. Creating a custom admin path for your Orchard Core CMS tenant for improved security.

AdminUrlPrefix and appsettings.json in Orchard Core Tenants

Orchard Core allows you to customize the route to the backend on a tenant-by-tenant basis using the AdminUrlPrefix in the appsettings.json file. Using a custom prefix adds extra security so that visitors to your Orchard Core CMS website can't easily guess the location of the backend and allow them to either take advantage of vulnerabilities in Orchard Core or attempt brute-force attacks against your administrative login page.

Simply add AdminUrlPrefix to your tenant's appsettings.json file below with the prefix you would like to append to the admin backend. It is recommended for security reasons that you don't pick a prefix commonly used by other content management systems or host providers.

  "DatabaseProvider": "...",
  "RecipeName": "...",
  "OrchardCore_Admin": {
    "AdminUrlPrefix": "arugula"

In addition to modifying AdminUrlPrefix, I highly recommend you override the UserOptions in your Orchard Core website to create custom and secure URL's for user login, logoff, change password, and external logins.

You can view more developer notes and tutorials on Orchard Core Security.