Just occured to me: what's the point of password protecting www.yoursite.com/wp-admin when a user can just type www.yoursite.com/wp-login.php, bypassing the password on /wp-admin?

Am I missing something here? I've ready many blogs/posts that suggest adding this extra layer of protection to wp-admin using .htaccess/.htpasswd.

2 Answers 2


The protection from .htaccess is for the folder /wp-admin it's not for the URL

Open up your ftp programme (or download WordPress) and look inside /wp-admin

By only allowing your IP access this folder you're blocking a lot of possible exploit issues (as mentioned in comments below).

I always prefer to login at mysite.com/wp-admin and not login.php this way, if you're still logged in to your site, you go straight to the Admin section.

  • 1
    This also blocks bots or hooligans from posting to admin-ajax.php. Commented Jul 25, 2012 at 0:00
  • Thanks, that makes sense. I've gone ahead and password-protected wp-admin on my live server, but when I go to mysite.com/wp-admin, I receive a "Too many redirects error" - status 310. What does this mean and how can I fix it? Chrome's suggestion (clearing cache, allowing third-party cookies, etc.) did not solve this problem.
    – Mark Bubel
    Commented Jul 25, 2012 at 15:34
  • Hi mark remove the .httpswd protection and just have .htaccess with your ip address. You're probably blocking Wordpress processing functions with the password
    – Damien
    Commented Jul 25, 2012 at 18:16

Even accessing www.yoursite.com/wp-login.php will still prompt you for password. It's a good way to add another security layer on your site. The problem here is that you need to add a font-end login and registration if you need user to login.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.