1

I'm currently building a small business website and I'm hosting on a home server, and have hit a roadblock with not being able to enhance security because of Wordpress not following any of the rules I've put into .htaccess. I would like to preferably block access to the wp-login.php or wp-admin from other IP's than mine. So I used this bit of code that I'm finding all over the place: 

ErrorDocument 401 /path-to-your-site/index.php?error=404
ErrorDocument 403 /path-to-your-site/index.php?error=404

<IfModule mod_rewrite.c>

    RewriteEngine on
    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
    RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
    RewriteCond %{REMOTE_ADDR} !^IP Address One$
    RewriteCond %{REMOTE_ADDR} !^IP Address Two$
    RewriteCond %{REMOTE_ADDR} !^IP Address Three$
    RewriteRule ^(.*)$ - [R=403,L]

</IfModule>

, but that didn't work so I tried another bit:

# Block access to wp-admin.
order deny,allow
allow from x.x.x.x 
deny from all

(keep in mind these are going in the .htaccess in the wp-admin as instructed, but that didn't work so I copied it and put one in the "html" folder and neither worked), but none of those worked so I thought that it must just be something with the code. So I decided that I could just password protect wp-login.php with the .htpasswd file being out of the "html" folder and this code in both of the .htaccess files:

# Protect wp-login
<Files wp-login.php>

    AuthUserFile /var/www/.htpasswd
    AuthName "Private access"
    AuthType Basic
    require user insertusernamehere

</Files>

, however that didn't work either, making me think that WP isn't even seeing any of the rules in there.

This is currently the code in both of the .htaccess files: 

ErrorDocument 401 /var/www/html/wp-content/themes/zerif-lite/index.php?error=404
ErrorDocument 403 /var/www/html/wp-content/themes/zerif-lite/index.php?error=404

#Protect wp-login
<Files wp-login.php>

    AuthUserFile /var/www/.htpasswd
    AuthName "Private access"
    AuthType Basic
    require user wpsecure

</Files>

<IfModule mod_rewrite.c>

    RewriteEngine on
    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
    RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
    RewriteCond %{REMOTE_ADDR} !^INSERTMYIPHERE$
    RewriteRule ^(.*)$ - [R=403,L]

</IfModule>

(commented)Block access to wp-admin
order deny,allow
allow from INSERTMYIPHERE
deny from all
(commented)BEGIN WordPress
(commented)END WordPress

I've been fighting with this for a few days now, and have made little to no progress. I did look at this website: https://www.keycdn.com/support/htaccess-not-working/ to see if there was anything there, and apache "AllowOverride" was set "None" but changing it to "All" made no effect. I've tried to provide you with as much information, however, if you need more feel free to ask me.

Improve this question
6
  • Is your host running Apache or nginx?
    – Slam
    May 6, 2018 at 5:16
  • It is not enough to change "AllowOverride" to "all", you also need to restart the server
    – Mark Kaplun
    May 6, 2018 at 5:35
  • It's running Apache, and I always restart the service after making a change.
    – apt-get_install_cat
    May 6, 2018 at 5:56
  • So, you're not currently using "pretty" URLs? Where did you change AllowOverride? You don't just set this - it needs to be set for the specific directory path you are using and make sure it's not overridden. What version of Apache? Do you have AllowOverrideList set as well?
    – MrWhite
    May 6, 2018 at 11:15
  • es, I'm not using pretty URLs. I changed the "AllowOverride" in the "apache2.conf" file. I do not have "AllowOverrideList" set, is that in the conf file also? It's the current version of Apache, (i think, ill have to check) I didnt see a place to put the path there, and the website I mentioned didnt say anything about it.
    – apt-get_install_cat
    May 6, 2018 at 17:58

1 Answer 1

Reset to default
2

apache "AllowOverride" was set "None" but changing it to "All" made no effect
:
I changed the "AllowOverride" in the "apache2.conf" file.

It's still not clear where exactly you are setting AllowOverride. This directive can only be used in a directory context. ie. Inside a <Directory> container in your main server or VirtualHost config.

You should already have a section like the following (which should not be changed):

<Directory "/">
AllowOverride None
</Directory>

The server root (ie. "/") must only be set to None, otherwise Apache will search for .htaccess files all the way to the server root which could result in security/performance issues.

Instead, you should override this for your document root directory only. This will probably go in your specific <VirtualHost> for your site. (Or in the main server config - after the above <Directory> container - if you only have one site configured for the whole server.) For example:

<Directory "/var/www/html">
AllowOverride All
</Directory>

Assuming /var/www/html is the absolute filesystem path of your document root, in which the .htaccess file is located.

ErrorDocument 401 /var/www/html/wp-content/themes/zerif-lite/index.php?error=404
ErrorDocument 403 /var/www/html/wp-content/themes/zerif-lite/index.php?error=404

Aside: The path specified in the ErrorDocument directive should be a URL-path relative to the document root, not the server root.

RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$

keep in mind these are going in the .htaccess in the wp-admin as instructed

The first two conditions (RewriteCond directives) imply that these should be going in the root .htaccess file, not the .htaccess file in the /wp-admin subdirectory?

Improve this answer
6
  • After changing the right directive, and narrowing it down a little more, it seems that the "order deny,allow" is doing what it's supposed to, locking out people from the whole site, which makes sense since it's in the main site directory, even though it's not what I want it to do. Now, the "RewriteCond" part isn't doing anything, even though you had said that it seems like it should be in the main site directory. So, it seems that the "order deny,allow" is doing things right now. I tried to add a directive in the apache2 conf to also allow override in the wp-admin, but it seems to do nothing.
    – apt-get_install_cat
    May 7, 2018 at 1:14
  • So, should I do away with the "RewriteCond" and only use the "order deny,allow" although in the correct manner? Or should I keep the "RewriteCond" and make that work? (I also fixed the ErrorDocument, thanks for that. :))
    – apt-get_install_cat
    May 7, 2018 at 1:16
  • If RewriteCond / RewriteRule are not doing anything then maybe you don't have mod_rewrite installed? Remove the <IfModule mod_rewrite.c> wrapper - do you get an error. If you want to block access to the /wp-admin subdirectory then it makes sense to have an .htaccess file in the subdirectory just for this purpose. Using mod_authz_core is preferable to mod_rewrite. But note that Order deny,allow is an Apache 2.2 directive and deprecated on Apache 2.4+. You should be using Require ip ... etc. instead.
    – MrWhite
    May 8, 2018 at 23:58
  • Also, wp-login.php is in the document root - so any directive that blocks access to this file will also need to be in the .htaccess file in the root.
    – MrWhite
    May 8, 2018 at 23:58
  • Ok, so you had said that mod_authz_core is preferably, so I think that we should just troubleshoot that instead of also dealing with the modrewrite. So, I put commented out everything in the .htaccess in the root dir to narrow down problems. And all thats not commented in the wp-admin dir is <RequireAll> Require ip myip </RequireAll> however, this is not only blocking out others ip, but it is also blocking out mine. Am I using this in the correct syntax? Or am I missing something?
    – apt-get_install_cat
    May 11, 2018 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.