1

I'm currently building a small business website and I'm hosting on a home server, and have hit a roadblock with not being able to enhance security because of Wordpress not following any of the rules I've put into .htaccess. I would like to preferably block access to the wp-login.php or wp-admin from other IP's than mine. So I used this bit of code that I'm finding all over the place:

ErrorDocument 401 /path-to-your-site/index.php?error=404
ErrorDocument 403 /path-to-your-site/index.php?error=404

<IfModule mod_rewrite.c>

    RewriteEngine on
    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
    RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
    RewriteCond %{REMOTE_ADDR} !^IP Address One$
    RewriteCond %{REMOTE_ADDR} !^IP Address Two$
    RewriteCond %{REMOTE_ADDR} !^IP Address Three$
    RewriteRule ^(.*)$ - [R=403,L]

</IfModule>

, but that didn't work so I tried another bit:

# Block access to wp-admin.
order deny,allow
allow from x.x.x.x 
deny from all

(keep in mind these are going in the .htaccess in the wp-admin as instructed, but that didn't work so I copied it and put one in the "html" folder and neither worked), but none of those worked so I thought that it must just be something with the code. So I decided that I could just password protect wp-login.php with the .htpasswd file being out of the "html" folder and this code in both of the .htaccess files:

# Protect wp-login
<Files wp-login.php>

    AuthUserFile /var/www/.htpasswd
    AuthName "Private access"
    AuthType Basic
    require user insertusernamehere

</Files>

, however that didn't work either, making me think that WP isn't even seeing any of the rules in there.

This is currently the code in both of the .htaccess files:

ErrorDocument 401 /var/www/html/wp-content/themes/zerif-lite/index.php?error=404
ErrorDocument 403 /var/www/html/wp-content/themes/zerif-lite/index.php?error=404

#Protect wp-login
<Files wp-login.php>

    AuthUserFile /var/www/.htpasswd
    AuthName "Private access"
    AuthType Basic
    require user wpsecure

</Files>

<IfModule mod_rewrite.c>

    RewriteEngine on
    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
    RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
    RewriteCond %{REMOTE_ADDR} !^INSERTMYIPHERE$
    RewriteRule ^(.*)$ - [R=403,L]

</IfModule>

(commented)Block access to wp-admin
order deny,allow
allow from INSERTMYIPHERE
deny from all
(commented)BEGIN WordPress
(commented)END WordPress

I've been fighting with this for a few days now, and have made little to no progress. I did look at this website: https://www.keycdn.com/support/htaccess-not-working/ to see if there was anything there, and apache "AllowOverride" was set "None" but changing it to "All" made no effect. I've tried to provide you with as much information, however, if you need more feel free to ask me.

  • Is your host running Apache or nginx? – Slam May 6 '18 at 5:16
  • It is not enough to change "AllowOverride" to "all", you also need to restart the server – Mark Kaplun May 6 '18 at 5:35
  • It's running Apache, and I always restart the service after making a change. – apt-get_install_cat May 6 '18 at 5:56
  • So, you're not currently using "pretty" URLs? Where did you change AllowOverride? You don't just set this - it needs to be set for the specific directory path you are using and make sure it's not overridden. What version of Apache? Do you have AllowOverrideList set as well? – MrWhite May 6 '18 at 11:15
  • es, I'm not using pretty URLs. I changed the "AllowOverride" in the "apache2.conf" file. I do not have "AllowOverrideList" set, is that in the conf file also? It's the current version of Apache, (i think, ill have to check) I didnt see a place to put the path there, and the website I mentioned didnt say anything about it. – apt-get_install_cat May 6 '18 at 17:58
1

apache "AllowOverride" was set "None" but changing it to "All" made no effect
:
I changed the "AllowOverride" in the "apache2.conf" file.

It's still not clear where exactly you are setting AllowOverride. This directive can only be used in a directory context. ie. Inside a <Directory> container in your main server or VirtualHost config.

You should already have a section like the following (which should not be changed):

<Directory "/">
AllowOverride None
</Directory>

The server root (ie. "/") must only be set to None, otherwise Apache will search for .htaccess files all the way to the server root which could result in security/performance issues.

Instead, you should override this for your document root directory only. This will probably go in your specific <VirtualHost> for your site. (Or in the main server config - after the above <Directory> container - if you only have one site configured for the whole server.) For example:

<Directory "/var/www/html">
AllowOverride All
</Directory>

Assuming /var/www/html is the absolute filesystem path of your document root, in which the .htaccess file is located.


ErrorDocument 401 /var/www/html/wp-content/themes/zerif-lite/index.php?error=404
ErrorDocument 403 /var/www/html/wp-content/themes/zerif-lite/index.php?error=404

Aside: The path specified in the ErrorDocument directive should be a URL-path relative to the document root, not the server root.


RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$

keep in mind these are going in the .htaccess in the wp-admin as instructed

The first two conditions (RewriteCond directives) imply that these should be going in the root .htaccess file, not the .htaccess file in the /wp-admin subdirectory?

  • After changing the right directive, and narrowing it down a little more, it seems that the "order deny,allow" is doing what it's supposed to, locking out people from the whole site, which makes sense since it's in the main site directory, even though it's not what I want it to do. Now, the "RewriteCond" part isn't doing anything, even though you had said that it seems like it should be in the main site directory. So, it seems that the "order deny,allow" is doing things right now. I tried to add a directive in the apache2 conf to also allow override in the wp-admin, but it seems to do nothing. – apt-get_install_cat May 7 '18 at 1:14
  • So, should I do away with the "RewriteCond" and only use the "order deny,allow" although in the correct manner? Or should I keep the "RewriteCond" and make that work? (I also fixed the ErrorDocument, thanks for that. :)) – apt-get_install_cat May 7 '18 at 1:16
  • If RewriteCond / RewriteRule are not doing anything then maybe you don't have mod_rewrite installed? Remove the <IfModule mod_rewrite.c> wrapper - do you get an error. If you want to block access to the /wp-admin subdirectory then it makes sense to have an .htaccess file in the subdirectory just for this purpose. Using mod_authz_core is preferable to mod_rewrite. But note that Order deny,allow is an Apache 2.2 directive and deprecated on Apache 2.4+. You should be using Require ip ... etc. instead. – MrWhite May 8 '18 at 23:58
  • Also, wp-login.php is in the document root - so any directive that blocks access to this file will also need to be in the .htaccess file in the root. – MrWhite May 8 '18 at 23:58
  • Ok, so you had said that mod_authz_core is preferably, so I think that we should just troubleshoot that instead of also dealing with the modrewrite. So, I put commented out everything in the .htaccess in the root dir to narrow down problems. And all thats not commented in the wp-admin dir is <RequireAll> Require ip myip </RequireAll> however, this is not only blocking out others ip, but it is also blocking out mine. Am I using this in the correct syntax? Or am I missing something? – apt-get_install_cat May 11 '18 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.