The admin panel: the part of your app only you see

The admin panel is the part of the app where the business does its work: orders, bookings, customers, content, settings. Customers never see it, but you and your team are in it every day, and for anyone trying to steal data it's the most interesting door. That's why it deserves as much thought as the screens your customers use.

What a good panel does

A good panel answers one simple question: what do I need to do today? The start screen shows new orders, today's bookings or requests nobody has answered yet, not pretty charts nobody reads.

The rest comes down to a few habits:

• search by name, phone or order number in every list;
• common actions in one click: confirm, cancel, mark as delivered;
• everyday edits without a developer: hours, text, the menu, photos;
• export to Excel for your accountant or your own reports.

When we sketch an app, the admin panel gets its own screens in the prototype. That way you see early whether a staff member can confirm a booking in ten seconds or needs five pages to do it.

Roles: who sees what

Not everyone on the team needs everything. OWASP, the go-to organization for application security, recommends the principle of least privilege: each person gets only the access their job requires. An example for a service business:

OWASP also says access should be denied by default: a new role sees nothing until it's explicitly granted something. And permissions should be reviewed now and then, because people change jobs and their access tends to stay behind.

A hidden menu isn't security

This is where a lot of apps go wrong. A staff member not seeing the "Users" button in the menu doesn't mean they can't get there. If they type the page address directly, or send the request from another tool, and the server doesn't check, they're in.

OWASP ranks access control failures first among the 2021 top risks and gives exactly this example: a regular user reaching admin pages by typing the URL. The rule is clear: permissions are checked on the server, on every request, and checks done only in the browser never decide anything. When we hand over a panel, we test this by requesting the forbidden addresses directly with a staff account.

Two-step login

An admin account protected only by a password is the weakest point in the app. OWASP recommends requiring multi-factor authentication for administrators and other high-privilege accounts and calls it by far the best defense against most password attacks; it cites a Microsoft analysis suggesting MFA would have stopped 99.9% of account compromises.

In practice that means a code from an authenticator app or a passkey on the phone. We wrote about passkeys in our passkeys article.

The activity log and GDPR

The panel should remember who changed what, and when: who canceled the order, who edited a customer's details, who exported the list. OWASP also says failed access attempts should be logged and admins alerted when they repeat.

The log helps with the law too. Article 32 of the GDPR requires measures appropriate to the risk: keeping data confidential and intact, being able to restore it in good time after an incident, and regularly testing your security measures. It also says anyone with access to personal data handles it only on the company's instructions. Roles, the log and backups are how you show you're doing that.

What to ask before you order a panel

1. What do I see first when I log in in the morning?
2. Which roles exist, and can I change them myself?
3. Where are permissions checked: in the menu, or on the server for every request?
4. Is two-step login mandatory for administrators?
5. Can I see who changed an order and when?
6. How is data restored if something gets deleted by mistake?

What drives the cost: how many roles and screens the panel has, how many reports and exports, and connections to other software (invoicing, couriers). See how we work on our App Dev services page.