How to Lock Down Admin Pages in a Base44 App

To lock down admin pages in a Base44 app, do three things: hide the admin screens from everyone who is not an admin, set the same rule on the data behind those screens, and test it while logged out and as a regular user. Hiding a menu link is not enough. Anyone who knows or guesses the page address can still try to open it.

Why hiding the menu link is not enough

Most AI-built apps put an "Admin" link in the menu and show it only to admin users. That is good for tidiness, not for security. The page itself and the data it loads are separate things, and both need a rule.

Think of a shop with a "Staff only" sign on the door. The sign helps. The lock is what keeps people out.

Step 1: Decide who is an admin

Write down the roles in your app. Most small apps need only two: admin (you and your team) and user (everyone else). Keep the list short, because every extra role is another rule to check.

Then check who currently holds the admin role. Remove anyone who does not need it, including old test accounts.

Step 2: Protect the page

Ask the AI builder for one specific change:

On every page under /admin, check the signed-in user's role. If the user is not an admin, redirect them to the home page and show nothing from the admin screen. Do not change any other pages.

Notice the last sentence. It keeps the builder from "helping" by editing things you did not ask about.

Step 3: Protect the data

This is the step people skip. If a regular user can still read your orders or customer list through the data layer, the locked page protects nothing.

Base44 lets you set rules on each data table. Its security settings documentation describes a User Property Check rule where you pick the User Role field and require the value Admin. Use it for reading, editing and deleting on any table that holds sensitive records, such as orders, invoices, messages and customer details.

Exact menu names can change, so follow the current Base44 docs when you set this up.

Step 4: Test it three ways

Do this after every change to roles or rules.

1. Logged out. Open an admin page address in a private browser window. You should be sent away or see nothing.
2. As a regular user. Sign in with a normal test account and try the same address. Then check that the data does not load anywhere else in the app.
3. As an admin. Confirm you can still do your job. A rule that is too strict can break your own backend functions or admin tools.

If any of the three fails, fix it before launch.

Common mistakes

• Locking the page but not the table. The most common gap.
• Leaving test accounts as admins. Delete them or lower their role.
• Giving everyone admin "just for now." It tends to stay that way.
• Never re-testing. New features can quietly add new open pages.

FAQ

Do I need a developer to do this? Not for the basics. The steps above are plain-language prompts and settings. For an app that stores payments or sensitive personal data, consider an outside security review as well.

Can the AI builder set this up for me? It can do much of it from a clear prompt, but verify the result yourself with the three tests above. Do not assume it worked.

What is the first thing to check today? Open one admin page address while logged out.

Next step

If you would rather have a structured process, Security Lockdown Pro is a downloadable pack of 12 staged prompts that adds an admin-only security dashboard to your Base44 app. It flags exposed routes and data, and gives you fix prompts to paste in. It is a prompt resource, not hosted software, and it does not replace manual testing or a professional audit. For a quick start, see our vibe coding security checklist and the free AI controls page.