Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a site running WordPress defined in a virtual host listening at port 80 (www.example.com).

I want to stop people accessing /wp-admin and wp-login.php but to allow access when they look in a different port like www.example.com:8080/wp-admin or www.example.com:8080/wp-login.php

I added some RewriteRules to show a 404 error page when they hit the site at port 80 and created a new virtual host for the same site that listens at port 8080 as follows:

<VirtualHost 192.168.3.20:80>
Options -Indexes +FollowSymlinks

RewriteEngine on
RewriteRule ^/wp-login.php /wp-content/themes/404.html [R=404,NC]
RewriteRule ^/wp-admin$ /wp-content/themes/404.html [R=404,NC]

DocumentRoot /var/www/html/wordpress
ServerName www.example.com
</VirtualHost>

<VirtualHost 192.168.3.20:8080>
DocumentRoot /var/www/html/wordpress
ServerName www.example.com
</VirtualHost>

It works well showing error 404 when accessing /wp-admin and wp-login.php. When accessing through www.example.com:8080/wp-admin or www.example.com:8080/wp-login.php, it shows the login page as expected, but after entering the credentials and pressing enter to continue, it shows me the error 404 page declared for the virtual host at port 80, and that is what I don't want and after a lot of testing I cannot avoid it.

Does anybody have an idea of how to solve it? Maybe I was trying a wrong approach to this?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

I'm sorry to say that I'm afraid what you're trying is not possible with WordPress. In your site settings, you defined the URL where your WordPress lives -- http://www.domain.com/. WordPress, in compliance with W3C specifications, always implements its redirects using the full host name as provided in its settings, so when you log in and it verifies your credentials, it then redirects you to http://www.domain.com/wp-admin, regardless of whether you came in on port 80, port 8080, or port 56348. I ran into this same problem myself when trying to set up an exact mirror of my WP blog on a different port for testing theme and plugin development.

To add extra security to your site's admin pages, you can try a couple of things:

  1. Keep the wp-login.php page solely available on port 8080, but you'll have to allow wp-admin to be accessed on port 80.
  2. If I'm not mistaken, you can set WordPress to require HTTPS for the admin section, and then use your 404 rules to block it on port 80. This has the same effect as what you're trying to accomplish for someone trying to directly access wp-admin or wp-login.php, however someone clicking on the Site Admin button on your blog will most likely be taken directly to the HTTPS wp-login.php.
  3. In combination with either of the above, you can add an additional password using Apache HTTP Digest authentication (don't use Basic). This then requires a user accessing your WP admin to know (or to crack) two separate passwords.
share|improve this answer
    
Thank you very much for your answer. I will configure it as stated in step 3. –  user79108 Apr 28 '11 at 7:39
    
the "according to w3c specifications" is non-sense. Even more so being related to a password protected part of the site. He's right on the rest. –  gcb May 14 '11 at 1:21
    
@gcb I refer you to RFC2616, section 14.30 -- the HTTP/1.1 Location header. Note that the definition explicitly requires "absoluteURI", i.e. one that includes protocol, host, and path. Hence why the OP here wasn't getting his separate host/port for part of WordPress, since WP follows the spec correctly but lacks an option to specify a host specifically for admin. So while it doesn't pertain to passwords, it does directly apply to this question and, specifically, to why he couldn't set up password-protected admin on port 8080. Not non-sense in the slightest. –  Kromey May 14 '11 at 4:18
    
HTTP/1.0 also requires an absolute URI in the Location header, by the way (see informational RFC1945), so even "downgrading" to that older protocol doesn't change that my answer contains no nonsense. –  Kromey May 14 '11 at 4:23
1  
The fact that it requires an absolute URI is one thing. the fact that it redirects to "full host name as provided in its settings" is another thing. and that's what was driving me insane. also, sorry that i sounded offensive, just wanted to point out it's WP's own business logic, not w3c recommendation. anyway, i've found now that someone at my company already wrote patches for wordpress to have a separate URI for sites (including multi-site) and another for the admin pages. I will ask around if it was already submitted to the community or if we can do that soon. thanks for the answer. –  gcb Jul 27 '11 at 8:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.