.htaccess file to protect wp-admin

Need to create wildcards for IPV6

[JohnW107]

I have the following in my .htaccess file to only allow certain ip addresses access to wp-admin.

It works fine but my ISP is constantly changing my IPV6. I would like to be able to use the first two octets and use wildcard for the rest.

I have looked everywhere for an answer that works.

<Files wp-login.php>
# set up rule order
order deny,allow
# default deny
deny from all
allow from 100.200.20.52
allow from 70.90.110.130
allow from 2001:183:4c25:3990:99g0:pp06:rbc5:999b fictitious address.

# Add additional IPs for access here

[lucy24]

Good lord. Is your server still running Apache 2.2, or have you not got around to updating your directives yet? One of these days they will introduce 2.6, and then I doubt mod_compat--which I hope is what you’re currently using--will be available.

The wording of your post makes it sound as if you didn't know that Allow/Deny directives--or the more up-to-date Require ip--don't need a full down-to-the-last-segment IP. You can say Allow from 100.200, Allow from 2001:183 and so on, using just as many elements as necessary, or sectors such as /19 or /22. No “wild cards”; you simply leave off the variable parts.

[Vortex13]

On almost all my WordPress sites I use a plugin that allows me to write my own url instead of wp-admin . If the user doesn't know the new url, they will get a 404.

[Brett_Tabke]

like lucy said, Require is the more modern way with apache 2.4 and up.

<Files wp-login.php>
Require all denied
Require ip 100.200.20.52
Require ip 70.90.110.130
Require ip 2001:183:4c25:3990::/64
</Files>

If you must stick with the older syntax, it won’t do what you want for IPv6. Switching to CIDR with Require ip is the way to handle it.

[mack]

If you do decide to rename wp-admin.php be sure to leave a version there that messes with them.. Looks like the login screen but does nothing. They will eventually give up.

Mack.

[Brett_Tabke]

The big problem with renaming or moving login is that so many wp updates will overwrite that - or worse, fail - during update.

[not2easy]

You can set permission to secure WP files, there are instructions. Because of the way WP is installed and set up, permissions are better than rules in .htaccess.

There is a link in this 2022 thread about hardening WP: [webmasterworld.com...]

[lucy24]

This is really a wider-ranging issue than wp. For example, if I had it to do over I would call my /includes/ directory by some other name. My test site features an array of improbable directory names, each goofier than the last.