i am trying to ban a spam bot IP from my wordpress, since the "limit login attempts" extension mails me multiple times every day, that the same IP is trying to login. so i added the following to the .htaccess file in the wordpress root:
order allow,deny allow from all deny from x.x.x.x
with x.x.x.x being the IP of the bot. still the bot is trying to login. so i tried my own IP and found out, that the htaccess order does only block the css of the login page. mywordpress.com/wp-login.php still shows the login form, though without any styling, but the bot can still try to gain access.
so how can i really block the entire site including the backend from certain IPs?