Protect Your Admin folder in WordPress by Limiting Access in .htaccess

As we mentioned while using WordPress 2.8.3, our site was attacked in an attempt to hack into our WP-Admin folder. Thankfully WordPress has found the bug and released a security patch in WordPress 2.8.4, but this attack made us take extra security measures with our site. We have limited access to our wp-admin folder by using .htaccess and assigning specific IPs that can access it. Before some hacker kept resetting our password and that was because they could see our wp-admin folder and see the login bar. Now no one but WPBeginner Editors can see our admin panel. In this article, we will show you how you can limit wp-admin folder access by IP address using .htaccess file.

First you need to open your .htaccess file located in your /wp-admin/ folder, and make a backup.

Note: Do not edit your Root .htaccess file, don’t paste these codes in there. It must be /wp-admin/.htaccess if you don’t see that file then create a blank file, name it .htaccess in your wp-admin folder.

Then paste the following code:

  AuthUserFile /dev/null  AuthGroupFile /dev/null  AuthName "WordPress Admin Access Control"  AuthType Basic  <LIMIT GET>  order deny,allow  deny from all  # whitelist Syed's IP address  allow from xx.xx.xx.xxx  # whitelist David's IP address  allow from xx.xx.xx.xxx  # whitelist Amanda's IP address  allow from xx.xx.xx.xxx  # whitelist Muhammad's IP address  allow from xx.xx.xx.xxx  # whitelist Work IP address  allow from xx.xx.xx.xxx  </LIMIT>

Paste your IP Address and upload the file.

Now if you have more than one IP make sure you list them there. For example, Work, Home, Vacation IP, if you ever use it. Each time you want to visit your wp-admin panel from another location, you would have to add an extra IP address. That is the only downside to this hack, but this will keep your wp-admin folder safe.