0

We recently blocked all IP addresses except mine and the company owner's from getting to /wp-login.php except today we discovered this has inadvertently blocked any other password protected page. By password protected I mean using the WP built in password as seen in this screenshot:

enter image description here

This is the segment of HTACCESS that we added which did stop people WP-Login but has also stopped people from using the Password Protected

# Block access to wp-login.php.
<Files wp-login.php>
order deny,allow
allow from 192...(ip)
allow from 192...(ip)
deny from all

Would there be an easy work around so we can block /wp-login.php without blocking other password protected pages?

2
  • When you say it has stopped them from using Password Protected, do they get a 401 error page or what happens? If you remove those entries from .htaccess, do the password protected pages work again? Jan 10 '20 at 19:24
  • yes it throws up error page and yes as soon as I removed it the password protected page works again @AlexanderHolsgrove
    – Ryan
    Jan 10 '20 at 20:04
0

Unfortunately a Password Protected post uses the wp-login.php file to process the password authentication for a post. So your Apache snippet of blocking all but those specific IPs is going to apply to anything that is password protected as well.

You can get nerdy and read code. In here you can see that Post Password form's action is set to run that data through wp-login.php?action=postpass

So that is the bad news, BUT:

I wonder if trying to open that up so that your other files in WP can access those files? (I am just purely guessing at this point)

# Block access to wp-login.php.
<Files wp-login.php>
order deny,allow
allow from 192...(ip)
allow from 192...(ip)
allow from localhost
allow from 127.0.0.1
deny from all

I hope that helps or gives you some insight!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.