WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

im trying to lock my admin panel from my users with adding htpsswrd file to wp-admin folder. but also i want my users can edit their profiles. so i create this file (htaccess)

AuthName "Username and password required" AuthUserFile ...../wp-admin/.htpasswd Require valid-user AuthType Basic

Order deny,allow Allow from all satisfy any

which works but, now when i try to access profiles, the site still askes password but also i can login. i think there are more files behind.

anyone know profile.php is using which files behind other than (user-edit.php)|(profile.php)|(users.php)

share|improve this question
Review this post by Ipstenu for tips: WordPress Login Protection With .htaccess at halfelf.org/2013/wp-login-protection-htaccess – Tara Jul 20 '13 at 23:56

Your behavior is logical. the profile.php page is in the protected /wp-admin/ folder.
the wp-login.php is in the root (/), which is not protected.

share|improve this answer

You can add protection to individual files like (in your htaccess file):

<Files test.php>
require valid-user
<Files test2.php>
require valid-user
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.