I have recently been learning how to harden WordPress using the steps outlined on this page.

When I get to the stage where I use the HTTP Basic Authentication (that's the one where the browser pops up with a login prompt) to protect the Login and Admin areas, and if I was to click cancel or fail to authenticate myself, the WordPress Login Form still appears, but in a less styled way.

I tried setting an ErrorDocument 401 (Authentication Required) in the .htaccess file, both in the WordPress root directory, and the wp-admin directory, with a message in quotes, that doesn't work. Then I tried setting an ErrorDocument 403 (Forbidden) in both, with the same message in quotes, and it still shows.

Does anyone have any ideas on how to get around this?

2 Answers 2


Managed to figure it out and want to share it with others in case they're having the same issue.

When protecting wp-admin, protect it using wp-admin/.htaccess file, but that only works for the wp-admin directory, and won't affect the wp-login.php file which is outside that directory.

Add protection to the wp-login.php file using the <files></files> directive in the root .htaccess file.

After doing that and reloading the page, failing to authenticate will no longer show the login page or anything related to wp-login.php.

Hope this helps someone out there. Please let me know if it does.

  • Yes that will work, however it's not good for woocommerce - or any plugin that has a membership / or logout facility - because wordpress shares the wp-login url for logout too and in such instances it therefore prevents the logout function from working correctly :-( Commented Feb 19, 2020 at 0:05

The code you need in .htaccess in your web root is:

<FilesMatch "wp-login.php">
Order Deny, Allow
deny from all
allow from xxx.xxx.xxx.xxx

Where xxx.xxx.xxx.xxx is your own IP address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.