We have our WP installs in folders on the server. We created folders called wp-admin and login to thwart hackers. However, incredulously, when you type in /wp-login.php it REDIRECTS to our mysite.com/folder.

I cannot believe WP is making it this easy.

How to disable anyone accessing wp-login.php through the address bar?

  • 1
    is it a question or a rant? easiest way to disable access to wp-login.php is in htaccess or just create a file named like that. Commented Sep 25, 2014 at 15:33

1 Answer 1


The best way to block access is in the pre_virtualhost.conf or your equivalent httpd configuration file.

This code will block any access to yourdomain.com/wp-admin and redirect to a blank page with message, "Denied". However, it will not block anyone trying to access yourdomain.com/somefolder/wp-admin.

<Location /wp-admin>
order deny,allow
Deny from all
allow from localhost
ErrorDocument 403 "Denied."

I would advise familiarizing yourself with mod_rewrite.c, which allows you to set explicit conditions with incredible flexibility.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.