I’ve created .htaccess password in order to add a layer of security to a WordPress installation. The .htpasswd file is located one level above the installation.

Yet, I’ve seen brute force attack attempts that seem to bypass this login and directly try to login in WordPress wpadmin, using the correct username (which is not “admin” but a random string of character).

I know that the .htaccess solution is not perfect. I was wondering if there was a way to make it more secure? I wonder how the attack is able to bypass the .htaccess protection, but that may be too broad a question.

Any suggestion will be welcomed.



P.S. I run my installation on a server that uses apache. My .htaccess file looks like this:

<Files wp-login.php> AuthUserFile /home/servername/.htpasswd AuthType Basic AuthName Restricted Order Deny,Allow Deny from all Require valid-user Satisfy any </Files>


3 Answers 3


What web server you use? If use nginx, you can try this to secure your wp-admin :

location ~ ^/(wp-login\.php$) {
 root /var/www/wordpress/;
     allow Your-ip-address;
     allow Your-second-ip-address;
     deny all;

Other way to secure your wp-admin from brute force attacks is to add this lines to your nginx.conf :

Limit Request

limit_req_status 403;
limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;

And those lines to your nginx virtual host conf:

# Limit access to avoid brute force attack
location = /wp-login.php {
        limit_req zone=one burst=1 nodelay;
        include fastcgi_params;
        fastcgi_pass php;

With this setup, the hackers will got 403 forbidden when try to bruteforce.

In your situation, I think the .htaccess setup may be wrong. If you don't have access to your web server and you use apache, your .htaccess file must be in your wordpress document root.

  • Thanks Nikolay, that’s very useful information. I’ve heard of nginx servers but I’m actually on a (cheaper) shared hosting solution that runs on apache. The .htaccess file is indeed in the root folder of my Wordpress installation. Only the .htpasswd is located one level above the installation. The login works correctly. When I try to access the admin page within a browser which does not already have the credentials, it asks me for it before even loading the admin page. Only then can I enter the Wordpress credentials.
    – Parneix
    Oct 8, 2015 at 19:15

First, contrary to Mark Kaplun's answer htaccess protecting wp-login is recommended in the Wordpress Codex and far from pointless. It will block many brute force/DDOS attacks BEFORE WP scripts are run and DB Connections and lookups are done i.e. drastically reduces server load; it enabled one of my sites to continue to be responsive instead of slow or falling over. Additionally many brute force tools are likely to halt immediately if presented with an authentication digest request.

As you are required to enter credentials your htaccess is working. But you need to do more.

Protect your admin directory via its own htaccess file. The Codex above suggests (see caveats) "blocking" by IP. This may not be practical if you travel, so I password protect the directory instead, and this works fine.

"(hackers) using the correct username (which is not “admin” but a random string of character)"

Prevent hackers identifying your (case insensitive) login names:

WP uses your username to create an author URL slug i.e. broadcasting it to the world (even in Google searches). Advice in articles to change your admin user name (without additional warnings) give those taking the advice a false sense of security and demonstrate the article authors lack of knowledge (I haven't seen one hacker article saying try to login with "admin" - but I've seen many suggesting finding author slugs.).

Try browsing yoursite.com/?author=1 (or author=2 or author=3) chances are the resulting URL or content will identify your (case insensitive) login name. N.B. if you changed the initial admin you may have deleted author "1").

Typically Hackers use security tools to list the first ten users (low numbers are more likely to be an admin). Use htaccess to foil most such tools and either 403 or redirect their requests e.g.

RewriteCond %{QUERY_STRING} author=
RewriteRule (.*) https://www.fbi.gov/investigate/cyber/%1 [R=302,L]

However; on most sites it will still be possible to manually identify username from author link URLs which themes normally include in posts. Yours is already known. The solution is to create a new admin user and immediately change its URL slug (user_nicename) entry in the WP database. You do this using a plugin (possibly) https://wordpress.org/plugins/edit-author-slug/ (which you can then remove). Or if confident by using phpMyadmin. If you can login using you new admin user then you can delete your old admin.

You can see the above suggestions in action on my site (click on any author (AW) link to see change to nicename/url slug; and add "?author=1" to the original link to see redirection).

  • This appeared on first page I checked but I've just seen it was asked 2 years ago. Whoops!
    – scytale
    Nov 12, 2017 at 14:42
  • there is nothing wrong with answering old questions. this is not a forum, think of the site more as a wikipedia built from questions and answers. Nov 12, 2017 at 16:43
  • as for the answer itself, that codex article is both out of date and is wrong. Since version 3.5 the xml-rpc end point is opened by default and is a major attack destination, and you can not protect it that way and still be able yo use xml-rpc which is used by major plugin like jetpack. Nov 12, 2017 at 18:07
  • Kevin, thanks for your kind response to my concern over adding a late answer. I see what you mean, there is now more debate on this qn, and debate is good. Although we have different viewpoints I do agree with much said in your answer. I'll likely add some comments in defence of my answer and maybe join the "comment debate" on your answer.
    – scytale
    Nov 13, 2017 at 17:54

The only viable protection is to use strong passwords (actually with my experience even medium strength passwords will be enough to keep away any random script kiddy).

The wp-login.php file is mainly UI and it is just one possible attack vector, with others will be the xml-rpc, rest api, and whatever plugins that let you do login via ajax.

using htpasswd file, with passwords that is not stronger than the password that you use in wordpress is kinda pointless, and if your password there is stronger than the one in wordpress, why is it?

To your other point.... wordpress do not do any real effort in hiding user names. Not always it is easy to get them, but there is no attempt to hide them. Therefor the fact that someone tried to login with the correct user name, it is just a fact of life when using wordpress and by itself it do not indicate any malicious attempt more complex than the "normal" script kiddies hacking attempts.

  • Using http auth does block pretty much all the standard bots because they only go for soft targets ("huh, I get a 401? let's move on to the next target"), as will just renaming wp-login.php (and blocking access to APIs). They won't add significant protection against a targeted attack, and obviously don't replace strong password.
    – janh
    Nov 12, 2017 at 15:07
  • I think that assuming bots will remain stupid all the time is a bad assumption, and in any case the same kiddies go for the xml-rpc end point as well, so unless you are going to protect it and the json-api one, you have done nothing. In the case of json-api this kind of thing will probably break your admin as well, if not now than in future releases, and on the xml-rpc front it will for sure break jetpack and other plugins. Nov 12, 2017 at 16:41
  • You don't have to be better than the bots to stop them, you just have to deviate from the pack - security by obscurity does work in these things, bots are not smart, and are built for mass checking, not targeted attacks. That's also why greylisting worked when few were doing it. As for the APIs, you are completely right, which is why I generally block them completely. Less exposure, less vulnerability.
    – janh
    Nov 12, 2017 at 17:54
  • Any security that ruins functionality is not much of a long term security. Even blocking with htpasswd is horrible UX by itself, blocking xml-rpc which is a major attack destination, when you have an easier and better way? just do not compute for me. If you want security by obscurity, the proper way is to change the URLs of the end points, not to put additional layer of login over them. Nov 12, 2017 at 18:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.