Know the moment an admin logs in from somewhere new
Magento's admin panel has no concept of a "known" location for an account. A shared, leaked, or brute-forced admin credential logging in from an IP that user has never used produces zero signal to anyone — until this module tracks known IPs per admin and emails you the instant a genuinely new one shows up.
Free forever, no credit card · just a free TVT Commerce account so we know where to send updates
One config screen. No dashboard to babysit.
Set a recipient once and it emails you when it matters — nothing to check, nothing to log into.
Per-admin known-IP tracking
Every admin user builds their own history of IPs they've logged in from. One admin's "normal" IP is never mistaken for another's.
Alerts only on genuinely new IPs
No noise from an admin logging in from the same office or home connection every day — you hear about it only when something actually changed.
Optional "alert on every login" mode
Want a full login log by email instead of just new-IP exceptions? One config toggle switches the module to alert on every single admin login.
Multiple recipient emails
Send alerts to one address or a whole security distribution list — configured in the same screen as everything else.
Never blocks or delays a real login
The alert fires after the login already succeeded. A mail server outage or a database hiccup is swallowed silently — it never becomes the reason someone can't get into their own admin.
Built-in alert-volume cap
A lightweight per-admin cap of 5 emails/hour stops a database incident or a misbehaving script from turning into an inbox flood.
Why this exists: Magento's admin authentication has no memory of where a given backend user has logged in from before — it checks a password, and that's the whole security signal. A stolen, guessed, or shared credential logging in from a brand-new IP looks exactly like the account holder logging in from home. This module adds the missing memory: a plugin on the admin login-success event checks a per-admin table of previously seen IPs, and only fires an email when the current one isn't in it. Mail and database errors inside that check are deliberately swallowed rather than surfaced — a broken SMTP setting should never be the reason a legitimate login fails or hangs. Full walkthrough: How to Get Notified When Someone Logs Into Your Magento Admin from a New Device.
Install & configure
1Download the module as a .zip from your account dashboard and copy it into app/code/TVTCommerce/AdminLoginAlert.
bin/magento module:enable TVTCommerce_AdminLoginAlert
bin/magento setup:upgrade
bin/magento cache:flush2Set your recipient email(s) and, if you want a full login log instead of just new-IP exceptions, turn on Always Alert. Save config — it's live immediately.
Guarding the front door too?
This module is free and focused on one job — Admin Login Alert watches your backend. TVT Commerce also builds Login Rate Limiter, which throttles credential-stuffing attempts against your storefront login by IP address, and AI Copilot, an in-admin assistant for catalog, sales, and CMS.