How does admin-ajax.php work?

Question

we are having some issues with an external developer. i am not a wp person so i turn to the masses to help out. we want to limit access to the wp-admin site to internal access only (via vpn). simply so it will not be attacked by external people. we can enumerate the admins from the site and do not want them to be phished.

the developer is saying we cant do that because the site needs to have the admin page accessible externally so the page will function. specifically the admin-ajax page.

what does the admin-ajax.php page do?

it is located in the admin section of wp.. is it accessed unauthenticated by end users? is it an unsafe practice to have this available to external users?

Answer 1

If you want to limit access to the WP backend ( ie wp-admin ) just use an .htaccess rule on the wp-admin directory. Try : http://davidwalsh.name/password-protect-directory-using-htaccess for a general overview and http://wordpress.org/support/topic/password-protecting-wp-admin for your specific case.

Answer 2

admin-ajax.php is part of the WordPress AJAX API, and yes, it does handle requests from both backend and front. Try not to worry about the fact that it is in wp-admin. I think that is a strange place for it too, but it is not a security problem in itself. How this relates to "enumerate the admins", I don't know.