How to Get Notified When Someone Logs Into Your Magento Admin from a New Device

Someone logged into your Magento admin last night from an IP address that has never touched your store before. Did anyone notice? If the answer is "only if we happened to be looking at the admin action log at the right moment," the honest answer is no — and that's the default state of a stock Magento install.

Magento tracks admin logins. It doesn't alert on them.

Every successful and failed admin login already gets written to admin_user and the admin action log — Magento keeps logdate, lastlogin, and failure counters per user. The data exists. What doesn't exist anywhere in core is a mechanism that looks at that data and tells anyone, in real time, "this login looks different from the ones before it." You'd only find a suspicious login by going and looking for it, which almost never happens until something has already gone wrong.

That gap matters more than it looks like on paper, because admin credentials in a typical Magento shop don't stay contained to one person sitting at one desk.

Think about who actually has your admin password. An agency that built the store. A freelancer who did a one-off project eight months ago. A former employee whose account was supposed to be disabled. A shared "admin" login three people on the team all use because creating individual accounts felt like overhead. Any one of those credentials logging in from an unfamiliar IP is exactly the kind of event you'd want to know about immediately — and exactly the kind of event Magento says nothing about.

How an alert-on-new-IP model actually works

The approach that avoids both silence and noise is to track, per admin user, the set of IP addresses that account has legitimately logged in from before. The first time a login comes from an IP outside that known set, it fires an alert. Logins from IPs the account has used before stay silent — no email every single morning from the same office network. If you'd rather be told about every login regardless of history, that's a config toggle, not a different feature; some teams genuinely want the fuller signal for admin accounts.

Two design choices matter more than the alerting logic itself:

It never blocks or delays the login. The check runs as an observer after authentication succeeds, not as a gate in front of it. A false positive means one extra email, never a locked-out admin scrambling to get back into their own store.
Per-admin alert volume is capped. If something upstream goes wrong — a shared hosting IP rotates, a VPN exit node changes constantly, a database hiccup resets what "known" means — you get a bounded number of alerts per admin, not an inbox flooded with hundreds of identical emails during the incident.

What this buys you that a password alone doesn't

A strong password stops someone from guessing their way in. It does nothing once a password is already known — through a phishing page, a reused credential from an unrelated breach, or simply an employee who left and kept their login working. New-IP alerting is the layer that assumes the password might already be compromised and gives you a chance to notice the moment it's actually used somewhere unexpected, rather than finding out weeks later from a bigger mess downstream.

Know the moment an unfamiliar IP logs into your admin — without ever standing between you and your own store.

Get Admin Login Alert — free