How to protect wp-admin through .htaccess?

Question

I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress.

I believe this can be handled through .htaccess. Does anyone know how?

Also, are there any files that will need access (i.e., admin-ajax.php)?

Answer 1

Basically, it should look like this:

AuthType     Basic
AuthName     NAME_THIS_THING
AuthUserFile PATH_TO_USER_FILE
<Files '*'>
    Require valid-user
</Files>
<Files 'admin-ajax.php'>
    Allow from all
    Satisfy any
</Files>

Replace the upper case parts with something real. admin-ajax.php is the only file that should be available without restriction.

The details of the user file are a little bit out of our scope, and they might depend on your operating system.

Answer 2

Instead of doing so, you can use this code to prevent others from opening your login page;

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^123\.123\.123\.123$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

(Replace xxx.xxx.xxx.xxx with your current IP)