Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

The goal: Completely remove the ability to access the WordPress backend on the production domain. Ex. return a 404 for http://example.com/wp-admin

Purpose: I don't want any possibility of WordPress' backend being accessed across the Internet. Instead, it will only be accessibly via VPN on an internal domain (i.e. http://example.internal/wp-admin. This ensures that no one could ever brute force attack the login page.

I could restrict logins to a given IP address, but I don't want to keep up with a list of IPs. I'd prefer to use the security my VPN already offers.

Consider that wp-admin still has to be accessible in some fashion because there could be resources that the frontend calls.

Are there any solutions beyond redirecting wp-login.php somewhere else?

share|improve this question

1 Answer 1

up vote 7 down vote accepted

If you know the sub-net of your VPN you could restrict access to /wp-admin via .htaccess using standard Apache rules.

<Directory /var/www/wp-admin/>
  Order deny,allow
  Allow from 192.168.1.0/24
  Allow from 127
</Directory>

Obviously you'd need to adjust the directory and IP address subnet to suit your needs.

To restrict access to a specific file:

<Files _FILE_.php>
    Order allow,deny
    Deny from all
    Allow from 127.0.0.1
</Files>

Again you can use a sub-net mask to suit your VPN.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.