A separate hostname is a separate session

An admin panel on the same hostname as the customer site shares a cookie namespace, a rate limit and a cross-site scripting blast radius.

# admin.example.com, separately configured
server {
    server_name admin.example.com;

    # its own session cookie name and domain
    fastcgi_param SESSION_COOKIE turkerdev_admin;
    fastcgi_param SESSION_DOMAIN admin.example.com;

    # its own rate limit zone
    limit_req zone=admin burst=20 nodelay;
}

A cookie scoped to admin.example.com is not sent to the customer site, which means a script injected into a product description cannot reach an administrator session. Network restriction on top is the second layer and is not a substitute — an office IP allowlist fails the moment somebody works from home, which is the situation that produces a hurried exception.