Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I found an article to protect the wp-admin/ and wp-login.php locations of my Wordpress installation.

When the locations are accessed w/o a "query string" the address is redirected. If the locations are accessed with the specified string, the access is given.

The problem is, I not able to find a way to exclude "wp-admin/admin-ajax.php" from this list.

RewriteEngine On
RewriteBase /

# replace ITSME with your own string
# and yourdomain.com with well….

# Is this a request for wp-login?
RewriteCond %{REQUEST_URI} ^/wp\-login\..*

# Check for the secret word
RewriteCond %{QUERY_STRING} .*ITSME=.*

# Set a cookie, so that all future requests will be auto-authenticated
RewriteRule ^.* /wp-admin/ [cookie=ITSME:true:.yourdomain.com:3600:/,R,L]

# Is this a request to the admin?
# comment out this line and you will be able to reach wp-login.php, but not anything in /wp-admin/ until you authenticate
RewriteCond %{REQUEST_URI} ^/wp\-login\..* [OR]
RewriteCond %{REQUEST_URI} ^/wp\-admin/.*
RewriteCond %{HTTP_COOKIE} !\bITSME\b

# Unathenticated, redirect to homepage with a disallowed indicator
RewriteRule ^.* /404.php [R,L]

This file is used for some ajax operations. When normal user visits the page, the "wp-admin" directory is blocked hence admin-ajax.php is inaccessible.

Hence excluding the admin-ajax.php file and making it open for all users will solve the problem. Any suggestion on how to do this ???

share|improve this question
Why did you choose this particular method of restricting requests to those locations? –  Shane Madden Nov 11 '12 at 19:14
add RewriteCond %{REQUEST_URI} !^/wp\-admin/admin\-ajax\.php as the first condition for the second RewriteRule... however your use case is for me very odd –  Kamil Šrot Nov 11 '12 at 19:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.