Testing Locally

With Docker (recommended)

From the admin/ directory:

docker compose up -d

Starts nginx on port 8080 + PHP-FPM. The deny rules are active. In production, login is at auth.nortonshop.net/login (which redirects to the admin panel at admin.nortonshop.net); locally the admin panel is accessible at http://localhost:8080/admin/.

Without Docker

PHP's built-in server with the dev router:

php -c admin/php-dev.ini -S localhost:8080 admin/dev-server.php

Test that sensitive files are blocked:

• http://localhost:8080/admin/ — should load the admin panel (in production: admin.nortonshop.net)
• http://localhost:8080/admin/users.json — should return 404
• http://localhost:8080/admin/config.php — should return 404
• http://localhost:8080/admin/.encryption-key — should return 404