I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress.

I believe this can be handled through .htaccess. Does anyone know how?

Also, are there any files that will need access (i.e., admin-ajax.php)?

2 Answers 2


Basically, it should look like this:

AuthType     Basic
<Files '*'>
    Require valid-user
<Files 'admin-ajax.php'>
    Allow from all
    Satisfy any

Replace the upper case parts with something real. admin-ajax.php is the only file that should be available without restriction.

The details of the user file are a little bit out of our scope, and they might depend on your operating system.


Instead of doing so, you can use this code to prevent others from opening your login page;

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^123\.123\.123\.123$
RewriteRule ^(.*)$ - [R=403,L]

(Replace xxx.xxx.xxx.xxx with your current IP)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.