I uploaded an html 403 and 404 page to my WordPress theme directory and if I hit a random mistake after .com such as .com/yyyy then it loads the 404 page for example - so all is good...

However...I would like the 403.php to be shown when someone outside my permitted IP string attempts to access my log in page.

This .htaccess rule works great BUT it create a never-ending loop as WordPress tries to find the 403.php page..

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^111\.111\.22\.33$
RewriteRule ^(.*)$ - [R=403,L]

So you can see on the last line that there is R=403 which is trying to find the 403 page, but it can't find it...

I therefore added the following lines (trying one at a time) but they didnt work:

ErrorDocument 403 /403.php
ErrorDocument 404 /404.php

and then I tried

ErrorDocument 403 /index.php?error=403
ErrorDocument 404 /index.php?error=404

And no joy...

Should the 403 and 404 template have WordPress specific php at the top of the template?

Or - how can i correctly call the 403.php when the user WITHOUT the correct IP address tries to access the log in page?


2 Answers 2


it create a never-ending loop as WordPress tries to find the 403.php page

Not WordPress, but Apache. WordPress never even sees the request.

You need to make an exception for your custom 403 error document, otherwise, the directives you have posted would issue another 403 for the error document itself... an endless loop.

If your ErrorDocument is defined like so:

ErrorDocument 403 /403.php

Then you can either create an exception before your existing rules like this:

RewriteRule ^403\.php$ - [L]

Which effectively instructs mod_rewrite/Apache to do nothing when the /403.php document is requested.

Or, incorporate this into your existing rule block. For example:

RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^111\.111\.22\.33$
RewriteRule !^403\.php$ - [R=403,L]

The ! prefix on the RewriteRule pattern negates the regex. So, this rule block will only be processed if the /403.php document is not requested. Note that [R=403,L] is the same as [F].

Or, you can simply disable your custom error document instead and use Apache's default error response:

ErrorDocument 403 default
  1. Wordpress has built in 404 and 403 template, it called in 404.php and 403.php in your template.

  2. OR, You can also defined which page / action will load when specified error code sent by detected http response code, put this on your functions.php file:

function detect_response_header(){ if (http_response_code() == 403) { // do some action here, include template file, redirect to outside wordpress environment (file that not WordPress not involved in your site) or whatever } } add_action('template_redirect','detect_response_header');



  • thanks but it didn't work...I added your functions snippet to my functions.php and where you wrote // do some action here > I added the full URL Path https ://mywebsite.com
    – Henry
    Sep 17, 2017 at 4:44
  • replace //do some action here with: header('Location: http://google.com/'); exit; and what happened? also you must test visit your site with condition your IP address not allowed
    – Asisten
    Sep 17, 2017 at 4:46
  • I made it like this but it didn't work: pastebin.com/FMJBUpkw
    – Henry
    Sep 17, 2017 at 4:51
  • 1
    wordpress do not have a 403 template AFAICT, and in any case this kind of 403 is generated outside of the scope of wordpress therefor your wordpress code normally will not have any chance of handling it. Sep 17, 2017 at 5:20
  • 2
    if access is blocked on htaccess level as the OP tries to do, wordpress will not run at all unless it is made explicitly to run, and in that case it is not going to have a 403 header unless someone sets it first. Sep 17, 2017 at 6:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.