I've decided to take the advice of protecting the /wp-admin directory using .htaccess on a website which keeps getting hacked.

Whenever I upload .htaccess to /wp-admin, my browser says /wp-admin has a redirect loop.

This is /wp-admin/.htaccess:

AuthUserFile /.../.htpasswd
AuthType Basic
AuthName “restricted”
Order Deny,Allow
Deny from all
Require valid-user
Satisfy any

A server redirection checker says there is a 302 (Moved Temporarily) redirect from /wp-admin to /wp-admin

If I delete /wp-admin/.htaccess, the redirect checker says there is still a 302 redirect from /wp-admin, but now it is to /wp-login.php?redirect_to=http%3A%2F%2Fwww.example.com%2Fwp-admin%2F&reauth=1

Bare in mind the server redirect checker is not logged into Wordpress.

Why does the presence of /wp-admin/.htaccess make /wp-admin redirect to itself?

Thanks.

PS - I am also using Better WP Security, but this made no changes to the site's /.htaccess in terms of /wp-admin. i.e. I didn't cloak /wp-admin

  • I used your .htaccess file and created my own .htpasswd file. It worked for me. Not sure what is causing the problem. There might be another Better WP Security rule that is interferring. – user42826 Jan 18 '14 at 8:29
up vote 7 down vote accepted

Redirection depends on server configuration. You need to add

ErrorDocument 401 default

to your main .htaccess to prevent redirection. You can refer the article Password-protect-wp-admin for more details

  • Nice one @Raja67. I didn't expect this to work but it did. – Steve Jan 19 '14 at 3:33
  • It works. But, why? – Jaec Jan 13 '17 at 8:13
  • 1
    @Jaec In the httpd config probably haven't got any error documents defined, so it is trying to return you to the base page, which throws an error, rinse, repeat. – Maduka Jayalath Apr 11 '17 at 7:47

I know it's an old question, but I recently ran into a similar problem and the ErrorDocument directive alone did not solve it for me. In my case, I had an incorrectly formatted .htpasswd file. When I recreated one using the htpasswd tool, everything worked as expected.

Just thought I'd pass this along as an option in case someone else runs into the same thing.

Next to "ErrorDocument 401 default" , you need to make sure the password file is readable by the webuser. In my case it was not and error log showed "[authn_file:error] [pid 15990] (13)Permission denied: [client 54.212.212.54:33556] AH01620: Could not open password file: /home/xxx/.htpasswd"

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.