How does admin-ajax.php work?

Question

We are having some issues with an external developer.

We want to limit access to the wp-admin site to internal access only (via VPN). Simply so it will not be attacked by external users. We can enumerate the admins from the site and do not want them to be phished.

Our developer is saying we can't do that because the site needs to have the admin page accessible externally so the page will function. specifically the admin-ajax page.

What does the admin-ajax.php page do?

It is located in the admin section of WordPress. Is it accessed unauthenticated by end users? Is it an unsafe practice to have this available to external users?

Answer 1

admin-ajax.php is part of the WordPress AJAX API, and yes, it does handle requests from both backend and front. Try not to worry about the fact that it is in wp-admin. I think that is a strange place for it too, but it is not a security problem in itself. How this relates to "enumerate the admins", I don't know.

Answer 2

For unauthenticated and untrusted users, you'll want to make two specific exceptions to your VPN / Firewall / Apache .htaccess, which are:

• example.com/wp-admin/admin-post.php
• example.com/wp-admin/admin-ajax.php

These are two auto-magic endpoints used by a lot by both internal WP and also various plugins.

Here's some explanation of what admin-post.php does:

• https://www.sitepoint.com/handling-post-requests-the-wordpress-way/

admin-ajax.php works in a very similar way, and a helpful explanation is here.

Answer 3

If you want to limit access to the WP backend (ex: wp-admin), just use a .htaccess rule on the wp-admin directory.

Check out this article for a general overview: Password Protect a Directory Using .htaccess

Also check out this topic for your specific case: Password protecting /wp-admin/