My server has both, wordpress and a webmail client installed.

  • Wordpress is accessible through: _http://a-totally-awesome-domain.com/
  • Webmail is accessible through: _http://a-totally-awesome-domain.com/webmail/

Now, the webmail client must not be accessible from outside of wordpress admin. Therefor I've added the following to .htaccess:

RewriteEngine On
# if the request's referer isn't from a php page on your site
RewriteCond %{HTTP_REFERER} !^http?://a-totally-awesome-domain.com
# deny access to the list of php files
RewriteRule ^(webmail/*)$ - [L,F]

This seems to work nicely: 403 is returned if an attempt to access _http://a-totally-awesome-domain.com/webmail/ is made. Now, for the wordpress admin integration part, I've created the following plugin, to display the webmail client inside of wordpress admin:

Plugin Name: Webmail integration plugin
Description: hm...
Author: what?
Version: 0.1

add_action('admin_menu', 'webmail_plugin_setup');

function webmail_plugin_setup() {
    add_menu_page( 'Webmail', 'Webmail', 'manage_options', 'webmail-plugin', 'webmail_plugin_init', 'dashicons-email-alt');

function webmail_plugin_init() {
    echo '<iframe style="width:100%; height: 800px; overflow: hidden; border=0;" src="http://a-totally-awesome-domain.com/webmail/"></iframe>';


This makes the webmail client nicely available inside wordpress admin.

The question is, is this sufficiently secure? I've read that iframes are considered security risks. Is there anything I need to worry about this approach? Considering that I'm the only user on the website, and that the webmail client is hidden behind wordpress admin, is there any possible security threat? If so, how could it be prevented?

Edit: Some more clarification:

Although the webmail client does support authentication, I'd rather not have its login page publicly accessible. Mainly because the webmail client only supports username/password login, while wordpress is secured by two factor authentication, brute force detection and some other security hardening features. So it seems to be a good idea to hide the webmail client behind the wordpress installation.

Please keep in mind that I'm a novice with wordpress and all that web-stuff, and your advise is highly appreciated, Thank you!

  • related: stackoverflow.com/questions/7289139/…
    – Tom J Nowell
    Mar 21, 2017 at 17:41
  • 1
    I'm unsure what you're concerned by here, or what the goal behind restricting webmail to just that page is. You never say why that has to be the case. If for example your webmail has no authentication, then no, it can never be secure unless you add a layer of authentication. HTTP Referrers can be faked. There just isn't enough information or context to answer this question at the moment. Please edit and add more details/context
    – Tom J Nowell
    Mar 21, 2017 at 17:43
  • Hello Tom, thank you very much for sharing this! I see, the referrer statement in .htaccess needs to be replaced then. Do you know how it should be rewritten to ensure that only the wordpress installation running on the same host can access to the webmail folder? Mar 21, 2017 at 22:07

1 Answer 1


no. it's not secure. because a curl http request can spoof any parameter in the request headers. What you should do? The least thing you can do is to create a htpassword file in the mail client directory which puts a username & password request before serving the content to the user. google about making a .htpassword file.

  • Thank you very much for the advise! Would it possible to hide direct access of the webmail folder through .htaccess? But making it still available inside wp-admin? So for example, blocking access through http_//server.com/webmail but allowing access through http_//server.com/wp-admin/webmail ? I've tried "Require local" in .htaccess, but it blocks any access to the webmail folder. Apr 6, 2017 at 8:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.