I am running a wordpress website, with AIO WP Security & Firewall plugin which inform me if there is a wrong login attempts.

/wp-admin contain a .htaccess where I set:

order deny,allow
deny from all
allow from // my IP

I still get emails from AIO Plugin that someone tried login with a strange Username from a different IP.

Is there another way how to get the login page an try to authenticate other than /wp-admin ??


You have denied the access to /wp-admin, however the user can still attempt to login via wp-login:


Therefore, you should also deny wp-login.php:

<Files "wp-login.php">
    Order allow,deny
    deny from all
    allow from // Your IP address
  • Well ok, if I add this I get Apaches 403. but when I rename /wp-admin to /myadmin the URL example.com/wp-login.php lead to 404 page. Why I still get access probe emails? – fips123 May 29 '17 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.