Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Just occured to me: what's the point of password protecting www.yoursite.com/wp-admin when a user can just type www.yoursite.com/wp-login.php, bypassing the password on /wp-admin?

Am I missing something here? I've ready many blogs/posts that suggest adding this extra layer of protection to wp-admin using .htaccess/.htpasswd.

share|improve this question

2 Answers 2

up vote 6 down vote accepted

The protection from .htaccess is for the folder /wp-admin it's not for the URL

Open up your ftp programme (or download WordPress) and look inside /wp-admin

By only allowing your IP access this folder you're blocking a lot of possible exploit issues (as mentioned in comments below).

I always prefer to login at mysite.com/wp-admin and not login.php this way, if you're still logged in to your site, you go straight to the Admin section.

share|improve this answer
1  
This also blocks bots or hooligans from posting to admin-ajax.php. –  Brian Fegter Jul 25 '12 at 0:00
    
Thanks, that makes sense. I've gone ahead and password-protected wp-admin on my live server, but when I go to mysite.com/wp-admin, I receive a "Too many redirects error" - status 310. What does this mean and how can I fix it? Chrome's suggestion (clearing cache, allowing third-party cookies, etc.) did not solve this problem. –  Mark Bubel Jul 25 '12 at 15:34
    
Hi mark remove the .httpswd protection and just have .htaccess with your ip address. You're probably blocking Wordpress processing functions with the password –  Damien Jul 25 '12 at 18:16

Even accessing www.yoursite.com/wp-login.php will still prompt you for password. It's a good way to add another security layer on your site. The problem here is that you need to add a font-end login and registration if you need user to login.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.