WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've decided to take the advice of protecting the /wp-admin directory using .htaccess on a website which keeps getting hacked.

Whenever I upload .htaccess to /wp-admin, my browser says /wp-admin has a redirect loop.

This is /wp-admin/.htaccess:

AuthUserFile /.../.htpasswd
AuthType Basic
AuthName “restricted”
Order Deny,Allow
Deny from all
Require valid-user
Satisfy any

A server redirection checker says there is a 302 (Moved Temporarily) redirect from /wp-admin to /wp-admin

If I delete /wp-admin/.htaccess, the redirect checker says there is still a 302 redirect from /wp-admin, but now it is to /wp-login.php?redirect_to=http%3A%2F%2Fwww.example.com%2Fwp-admin%2F&reauth=1

Bare in mind the server redirect checker is not logged into Wordpress.

Why does the presence of /wp-admin/.htaccess make /wp-admin redirect to itself?


PS - I am also using Better WP Security, but this made no changes to the site's /.htaccess in terms of /wp-admin. i.e. I didn't cloak /wp-admin

share|improve this question
I used your .htaccess file and created my own .htpasswd file. It worked for me. Not sure what is causing the problem. There might be another Better WP Security rule that is interferring. – user42826 Jan 18 '14 at 8:29
up vote 3 down vote accepted

Redirection depends on server configuration. You need to add

ErrorDocument 401 default

to your main .htaccess to prevent redirection. You can refer the article Password-protect-wp-admin for more details

share|improve this answer
Nice one @Raja67. I didn't expect this to work but it did. – Steve Jan 19 '14 at 3:33

I know it's an old question, but I recently ran into a similar problem and the ErrorDocument directive alone did not solve it for me. In my case, I had an incorrectly formatted .htpasswd file. When I recreated one using the htpasswd tool, everything worked as expected.

Just thought I'd pass this along as an option in case someone else runs into the same thing.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.