Administrative pages for websites should be protected by
A mechanism that requires only a password
Basic authentication
2/3 factor authentication
A mechanism with no lock-out, to prevent accidentally denying legitimate access