we are having some issues with an external developer. i am not a wp person so i turn to the masses to help out. we want to limit access to the wp-admin site to internal access only (via vpn). simply so it will not be attacked by external people. we can enumerate the admins from the site and do not want them to be phished.
the developer is saying we cant do that because the site needs to have the admin page accessible externally so the page will function. specifically the admin-ajax page.
what does the admin-ajax.php page do?
it is located in the admin section of wp.. is it accessed unauthenticated by end users? is it an unsafe practice to have this available to external users?