2

i'm trying to restrict access to admin dashboard (wp-admin.php) by specific static ip so tried to add .htaccess to the wp-admin and set

<FilesMatch "admin\.php$">
Order deny,allow
Deny from all
Allow from 10.0.0.0/24
</FilesMatch>

but is not working and tried to install bulletproof plugin too and change the <IfModule !mod_authz_core.c> <IfModule mod_access_compat.c> Order Allow,Deny Deny from all Allow from 000 </IfModule> </IfModule> </FilesMatch>

but not working to please any help and many thanks in advance.

  • Any luck with this? – jgraup Jan 22 '16 at 23:14
3

By the time admin_init rolls around you should know if you're doing AJAX or not. If you're not, then check the IP. Keep in mind that anyone can fake that number.

add_action('admin_init', function() {

    if(defined('DOING_AJAX') && DOING_AJAX) {
        return; // ignore ajax
    };

    $ip = $_SERVER[ 'REMOTE_ADDR' ];

    if($ip !== '10.0.0.0') {
        wp_die(__('You are not allowed to access this part of the site'));
    }
});
  • Should just use 'REMOTE_ADDR' I think, the rest are insecure and almost certainly unnecessary... – bonger Dec 22 '15 at 21:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.