1

I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress.

I believe this can be handled through .htaccess. Does anyone know how?

Also, are there any files that will need access (i.e., admin-ajax.php)?

1

Basically, it should look like this:

AuthType     Basic
AuthName     NAME_THIS_THING
AuthUserFile PATH_TO_USER_FILE
<Files '*'>
    Require valid-user
</Files>
<Files 'admin-ajax.php'>
    Allow from all
    Satisfy any
</Files>

Replace the upper case parts with something real. admin-ajax.php is the only file that should be available without restriction.

The details of the user file are a little bit out of our scope, and they might depend on your operating system.

|improve this answer|||||
0

Instead of doing so, you can use this code to prevent others from opening your login page;

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^123\.123\.123\.123$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

(Replace xxx.xxx.xxx.xxx with your current IP)

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.