4

I was reading this answer, and tried to used its guide to hide login page. It suggest to edit .htaccess file of my website to something like this:

RewriteEngine On
RewriteBase / 
##### ABOVE THIS POINT IS ALREADY INSERTED BY WORD PRESS
##### Michi’s code is BELOW #####
RewriteCond %{REQUEST_URI} wp-admin/
RewriteCond %{QUERY_STRING} !YOURSECRETWORDHERE
RewriteRule .*\.php [F,L]
RewriteCond %{QUERY_STRING} !YOURSECRETWORDHERE
RewriteRule ^ADMINFOLDER/(.*) wp-admin/$1?%{QUERY_STRING}&YOURSECRETWORDHERE [L]
##### Michi’s code is ABOVE #####
##### BELOW THIS POINT IS ALREADY INSERTED BY WORD PRESS
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

My .htaccess file starts with these lines:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

I want to know if I add anything between # BEGIN WordPress and # END WordPress is it possible that it will be overwritten by wordpress or not? This is usual about automated scripts but since it is not mentioned any warnings, I want to know may be it is safe to add some rules inside this block.

5

Wordpress uses those markers to put its rules between. I never have and never would put custom rules in there.

Check out insert_with_markers() and save_mod_rewrite_rules() in wp-admin/includes/misc.php

Most notably this comment block which answers your question:

/**
 * Inserts an array of strings into a file (.htaccess ), placing it between
 * BEGIN and END markers.
 *
 * Replaces existing marked info. Retains surrounding
 * data. Creates file if none exists.
 */
  • So how can I add requested lines? Should I write a new IfModule for my own out of markers block? – VSB Mar 15 '18 at 21:43
  • give it a shot. try above, try below. the if block is just making sure you have the module, i guess its good practice to use, but its your server so you know if you have it or not. – David Sword Mar 15 '18 at 21:49
  • These directives should go above the WP front-controller. Whether you should use the <IfModule> container is not simply a case of "good practise". If these directives are being used on multiple configs, where mod_rewrite might not be installed and you are happy for these directives to fail silently (and not do anything, ie. not protect your admin area), then include the <IfModule> wrapper. But otherwise, you should not include the <IfModule> wrapper (as David states, "you know whether you have it or not"). – MrWhite Mar 17 '18 at 2:17
1

Aside: Michi's code is not quite correct, and perhaps not as secure as you might think...

##### Michi’s code is BELOW #####
RewriteCond %{REQUEST_URI} wp-admin/
RewriteCond %{QUERY_STRING} !YOURSECRETWORDHERE
RewriteRule .*\.php [F,L]
RewriteCond %{QUERY_STRING} !YOURSECRETWORDHERE
RewriteRule ^ADMINFOLDER/(.*) wp-admin/$1?%{QUERY_STRING}&YOURSECRETWORDHERE [L]
##### Michi’s code is ABOVE #####

The first RewriteRule is missing a substitution argument. This will result in the request being (incorrectly) rewritten to /[F,L], which will result in a 404. Ok, so access is essentially blocked, but the intention is to serve a 403 Forbidden (which is what the F flag is for). So, the following:

RewriteRule .*\.php [F,L]

Should be rewritten as:

RewriteRule \.php$ - [F]

Note the use of the hyphen (-) for the second argument. This looks like an accidental omission in the original code. Also, no need for the L flag when the F flag is used.


RewriteCond %{QUERY_STRING} !YOURSECRETWORDHERE
RewriteRule ^ADMINFOLDER/(.*) wp-admin/$1?%{QUERY_STRING}&YOURSECRETWORDHERE [L]

This second rule allows you to gain access if you know the ADMINFOLDER. The YOURSECRETWORDHERE is essentially bypassed (and not required by the end user)!? So, the ADMINFOLDER is really the "secret" that should be long and cryptic. (TBH, there's no need for 2 "secrets" here, when 1 will do.)


Any blocking directives like this should go before the WordPress front-controller. (Although if you are only blocking physical files then it doesn't strictly matter in order to be functional, since the WP front-controller only routes URL paths that don't map to physical files/directories.)

0

This is usual about automated scripts

Exactly. When wordpress will need to regenerate the htaccess rule it will read the current file and replace the "wordpress" section in it. If you need rules to be in that section, you can write a plugin to override/change the rules being generated.

Side notes: obscurity is not security, brute force is not how sites are getting hacked, and you will need to disable xml-rpc, and maybe later the rest-api as well.

-3

No it shouldn't interfere, I have rules inside that block and they are all still active, even after changing permalink structure. Hope this helps.

  • 2
    in that case you should stop putting rules there – Mark Kaplun Mar 15 '18 at 21:37

protected by Community Apr 13 '18 at 6:22

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.