This lock only lives in your browser — it keeps casual visitors out but is not a real security system. For public hosting, protect this /admin folder at the server level too (e.g. HTTP basic auth from your host).