I've decided to take the advice of protecting the /wp-admin directory using .htaccess on a website which keeps getting hacked.

Whenever I upload .htaccess to /wp-admin, my browser says /wp-admin has a redirect loop.

This is /wp-admin/.htaccess:

AuthUserFile /.../.htpasswd
AuthType Basic
AuthName “restricted”
Order Deny,Allow
Deny from all
Require valid-user
Satisfy any

A server redirection checker says there is a 302 (Moved Temporarily) redirect from /wp-admin to /wp-admin

If I delete /wp-admin/.htaccess, the redirect checker says there is still a 302 redirect from /wp-admin, but now it is to /wp-login.php?redirect_to=http%3A%2F%2Fwww.example.com%2Fwp-admin%2F&reauth=1

Bare in mind the server redirect checker is not logged into Wordpress.

Why does the presence of /wp-admin/.htaccess make /wp-admin redirect to itself?


PS - I am also using Better WP Security, but this made no changes to the site's /.htaccess in terms of /wp-admin. i.e. I didn't cloak /wp-admin

  • I used your .htaccess file and created my own .htpasswd file. It worked for me. Not sure what is causing the problem. There might be another Better WP Security rule that is interferring.
    – user42826
    Jan 18, 2014 at 8:29

4 Answers 4


Redirection depends on server configuration. You need to add

ErrorDocument 401 default

to your main .htaccess to prevent redirection. You can refer the article Password-protect-wp-admin for more details

  • Nice one @Raja67. I didn't expect this to work but it did.
    – Steve
    Jan 19, 2014 at 3:33
  • It works. But, why?
    – Jaec
    Jan 13, 2017 at 8:13
  • 1
    @Jaec In the httpd config probably haven't got any error documents defined, so it is trying to return you to the base page, which throws an error, rinse, repeat. Apr 11, 2017 at 7:47

I know it's an old question, but I recently ran into a similar problem and the ErrorDocument directive alone did not solve it for me. In my case, I had an incorrectly formatted .htpasswd file. When I recreated one using the htpasswd tool, everything worked as expected.

Just thought I'd pass this along as an option in case someone else runs into the same thing.


Next to "ErrorDocument 401 default" , you need to make sure the password file is readable by the webuser. In my case it was not and error log showed "[authn_file:error] [pid 15990] (13)Permission denied: [client] AH01620: Could not open password file: /home/xxx/.htpasswd"


Thanks Raja67, I had to do 403 to get mine to work:

ErrorDocument 403 default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.