Attackers don't go through the public site, they go through the admin panel. It's the surface with the most power and, usually, the least scrutiny.
The baseline: role-based access so a clerk can't reach admin functions, individual accounts instead of a shared login, and an audit log that records who changed what. When something goes wrong, the log is how you answer 'who did this.'
Add rate limiting on login, lock out after repeated failures, and don't expose the panel on an obvious path. None of this is sophisticated, it's the difference between a panel that resists a casual attack and one that doesn't.
