I'm attempting to limit access to wp_admin by IP address but I still have a few that are getting through. I have an htaccess file in my wp_admin folder with the following:

# Block access to wp-admin.
order deny,allow
allow from x.x.x.x 
deny from all

I've tested the implementation by trying to access the login page from IP addresses that are not on the list and it seems to be working. I have Wordfence installed and I continue to received failed login attempt notifications by IP's that are not on my list. Does this security implementation also block bots? I'm wondering how this IP/bot is sneaking through.


1 Answer 1


IMHO this is not the best method of protecting your WP Admin. IPs can be spoofed. This method also restricts you to specific IPs which can be annoying if you wish to access it from a different office/location.

I'd recommend either a simple server-based password protection on the wp-admin directory. Of course, the downside is that this requires that you remember the password, or use a very secure web-based centralised password system and just remember one password for everything.

Read this for instructions: http://www.wpbeginner.com/wp-tutorials/how-to-password-protect-your-wordpress-admin-wp-admin-directory/

Best idea is 2 factor authentication though, ie. a password and then a SMS to your phone, or similar double-step process.

There's no one single answer for everyone - but I believe that in most cases there has to be a balance between practicality and tight security.

If you really want to shut it down, deny all in htaccess, and then SSH into the server whenever you wish to change it to temporarily allow access from the specific IP you are using and change it back once you're done - you could combine that with 2 factor auth and I'd doubt anything would ever get through.

Brute force attacks often rely on sending direct POST requests to your wp-login.php, so requiring that your domain is the referrer for any POST requests can help stop bots.

Another way you can protect your WordPress site is by including a link to your login and then only allowing login requests from your domain name. (Replace example.com with your domain).

<IfModule mod_rewrite.c> 
RewriteEngine on 
RewriteCond %{HTTP_REFERER} !^http://(.*)?example.com [NC] 
RewriteCond %{REQUEST_URI} ^(.*)?wp-login.php(.*)$ [OR] 
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$ 
RewriteRule ^(.*)$ - [F] 

And inhibiting access to xmlrpc.php can substantially reduce attacks, however some external services may be affected by this:

<Files ~ "xmlrpc.php"> 
Order allow,deny 
Deny from all 
  • I understand how this method of protecting the admin area could be annoying but I really don't have many users accessing the site and the individuals that do, typically only access the site from the office or home. So, I have all of the necessary IP's accounted for. For our situation this seemed to be the simplest way to secure it. The IP address that is getting through isn't spoofing because I can see the original IP.
    – brandozz
    Nov 30, 2015 at 17:59
  • In my experience, IP blocking is not foolproof. People rave about Wordfence, but I haven't found it to be a great solution. It is a quick and dirty solution for those who don't have too much of an idea, but it is not rock solid. I prefer BulletProof Security Pro bit.ly/bpsprowps or Ninja Firewall bit.ly/ninjafw both of which use htaccess extensively to protect the site before reaching WP) and GOTMLS gotmls.net which does a better job of finding and cleaning hacked sites. wp-admin dir pword protect with htaccess deny, and xmlrpc.php blocking is the basics though.
    – garth
    Dec 1, 2015 at 3:50
  • but @brandozz I get what you are saying. All I can think is that you may have a front end login activated somewhere. I use Cloudflare to proxy my sites as well, and by hiding the site by using non-standard hostnames for any hostnames you aren't proxying through Cloudflare (ie. sftp or directftp instead of ftp) , the vast majority of attempts don't even make the server.
    – garth
    Dec 1, 2015 at 6:49
  • codex.wordpress.org/Brute_Force_Attacks might be worth a review as well
    – garth
    Dec 1, 2015 at 6:55
  • as of yesterday I've removed the IP blocking. It didn't seem to be working properly. Someone in one of our offices in South Africa was able to access the admin area even though the IP wasn't listed in the htaccess file. I'm currently using Wordfence which I do like but I'll take a look at the other options that you have listed above. Thanks for the help!
    – brandozz
    Dec 1, 2015 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.