I think we can fix that. Go to Web Application Firewall, Configure WAF, on the first tab, set "Allow administrator access only to IPs in Whitelist" to No. That will allow any IP to log in to the back end as long as they know the rest of your secrets. As you have discovered, that feature works best with static IP addresses.
You should use the "Administrator secret URL parameter" on that same page. With a value in that field, you need to call your administrator login page with: www.mysite.com/administrator/index.php?secret. If the bad guys can't fine the login page, they can't attack the site. That feature has the advantage of being passive, you add the secret parameter to your bookmark and you can forget about it.
You can also use the Password-protect Administrator feature from the main Admin Tools page. This one is a little more intrusive, it prompts you for an additional user ID and password before you can access anything from the back end of the site. Some servers do not support this feature but most do.
Dale L. Brackin
Support Specialist
English: native
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!
????
My time zone is
EST (UTC -5) (click here to see my current time in Philadelphia, PA)