How do you harden the Magento admin?

The admin panel is the most-attacked surface on any store. We harden it with: two-factor authentication (2FA) enforced for all users, a custom admin path (no default /admin), brute-force lockout and rate-limiting, IP allow-listing where practical, removal of stale accounts, and least-privilege role review. Combined, these close the credential-stuffing and brute-force routes that account for most admin compromises.