adding rewrite rules in .htaccess

Question

I was reading this answer, and tried to used its guide to hide login page. It suggest to edit .htaccess file of my website to something like this:

RewriteEngine On
RewriteBase / 
##### ABOVE THIS POINT IS ALREADY INSERTED BY WORD PRESS
##### Michi’s code is BELOW #####
RewriteCond %{REQUEST_URI} wp-admin/
RewriteCond %{QUERY_STRING} !YOURSECRETWORDHERE
RewriteRule .*\.php [F,L]
RewriteCond %{QUERY_STRING} !YOURSECRETWORDHERE
RewriteRule ^ADMINFOLDER/(.*) wp-admin/$1?%{QUERY_STRING}&YOURSECRETWORDHERE [L]
##### Michi’s code is ABOVE #####
##### BELOW THIS POINT IS ALREADY INSERTED BY WORD PRESS
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

My .htaccess file starts with these lines:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

I want to know if I add anything between # BEGIN WordPress and # END WordPress is it possible that it will be overwritten by wordpress or not? This is usual about automated scripts but since it is not mentioned any warnings, I want to know may be it is safe to add some rules inside this block.

Answer 1

Wordpress uses those markers to put its rules between. I never have and never would put custom rules in there.

Check out insert_with_markers() and save_mod_rewrite_rules() in wp-admin/includes/misc.php

Most notably this comment block which answers your question:

/**
 * Inserts an array of strings into a file (.htaccess ), placing it between
 * BEGIN and END markers.
 *
 * Replaces existing marked info. Retains surrounding
 * data. Creates file if none exists.
 */

Answer 2

Aside: Michi's code is not quite correct, and perhaps not as secure as you might think...

##### Michi’s code is BELOW #####
RewriteCond %{REQUEST_URI} wp-admin/
RewriteCond %{QUERY_STRING} !YOURSECRETWORDHERE
RewriteRule .*\.php [F,L]
RewriteCond %{QUERY_STRING} !YOURSECRETWORDHERE
RewriteRule ^ADMINFOLDER/(.*) wp-admin/$1?%{QUERY_STRING}&YOURSECRETWORDHERE [L]
##### Michi’s code is ABOVE #####

The first RewriteRule is missing a substitution argument. This will result in the request being (incorrectly) rewritten to /[F,L], which will result in a 404. Ok, so access is essentially blocked, but the intention is to serve a 403 Forbidden (which is what the F flag is for). So, the following:

RewriteRule .*\.php [F,L]

Should be rewritten as:

RewriteRule \.php$ - [F]

Note the use of the hyphen (-) for the second argument. This looks like an accidental omission in the original code. Also, no need for the L flag when the F flag is used.

---

RewriteCond %{QUERY_STRING} !YOURSECRETWORDHERE
RewriteRule ^ADMINFOLDER/(.*) wp-admin/$1?%{QUERY_STRING}&YOURSECRETWORDHERE [L]

This second rule allows you to gain access if you know the ADMINFOLDER. The YOURSECRETWORDHERE is essentially bypassed (and not required by the end user)!? So, the ADMINFOLDER is really the "secret" that should be long and cryptic. (TBH, there's no need for 2 "secrets" here, when 1 will do.)

---

Any blocking directives like this should go before the WordPress front-controller. (Although if you are only blocking physical files then it doesn't strictly matter in order to be functional, since the WP front-controller only routes URL paths that don't map to physical files/directories.)

Answer 3

This is usual about automated scripts

Exactly. When wordpress will need to regenerate the htaccess rule it will read the current file and replace the "wordpress" section in it. If you need rules to be in that section, you can write a plugin to override/change the rules being generated.

Side notes: obscurity is not security, brute force is not how sites are getting hacked, and you will need to disable xml-rpc, and maybe later the rest-api as well.

Answer 4

No it shouldn't interfere, I have rules inside that block and they are all still active, even after changing permalink structure. Hope this helps.