Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am seeking for method to prevent access to Wordpress admin folder "wp-admin", but also i need apache to generate 404 error (Not found) for all, but not selected IPs. I found this post Returning 404 code for unauthorized attempts and tried Rewrite solution, but does not work for me.

So i keeping all websites in /usr/local/www/apache22/data and tried to use such config in httpd.conf (Apache2.2 FreeBSD 9.1)

<Directory "/usr/local/www/apache22/data">
RewriteEngine on
RewriteCond %{REMOTE_ADDR} != [OR]
RewriteCond %{REMOTE_ADDR} !=
RewriteRule ^wp-admin($|/) - [L,R=404]

For example, location of wp-admin for website is: /usr/local/www/apache22/data/

share|improve this question
Why do you want to do this? Why isn't simply denying access (HTTP/403) for unauthorized IP addresses (which you can do with simple Allow/Deny rules) adequate? – voretaq7 Sep 25 '13 at 21:26
I have been awaiting for such reply. The reason is to obfuscate bad bots trying to guess presence of Wordpress installed. So if they get 404 error then they won't try to explore for wordpress vulnerabilities. – Demontager Sep 26 '13 at 6:09
is it not possible to actually MOVE the wp-admin stuff? If you can just move the file/folder to a new location you get your 404, your obfuscation, and you aren't doing absolutely silly (breaking internet standards) things to do it... – Daniel Widrick Sep 26 '13 at 6:18
To answer my own questions: Can't move wp-admin...easily... with that said, lets move on... WHERE have you added the above code? httpd.conf? .htaccess? is mod_rewrite reloaded and enabled in apache? have you restarted apache since you made the changes? edit the question with your responses and we will go from there. – Daniel Widrick Sep 26 '13 at 6:23
I mentioned in question already where i have added rules. Sure restarted apache, mod_rewrite loaded and working fine as plenty of my website using it. Regarding moving wp-admin, sure i can use bash script to rename all in one shot, but i'm curious (and actually going to use) how to accomplish this without touching core files. – Demontager Sep 26 '13 at 6:37

OK, First let me say that your entire premise is flawed: There are many other ways besides the presence of /wp-admin to determine that you're using Wordpress. You're attempting Security through Obscurity, and since you're not obscuring everything you aren't doing a particularly elegant job of it.

Those inherent problems aside, at a quick glance your RewriteRule seems to be wrong.
Per the Apache documentation:

What is matched?

In VirtualHost context, The Pattern will initially be matched against the part of the URL after the hostname and port, and before the query string (e.g. "/app1/index.html").

In Directory and htaccess context, the Pattern will initially be matched against the filesystem path, after removing the prefix that led the server to the current RewriteRule (e.g. "app1/index.html" or "index.html" depending on where the directives are defined).

Simply put that means you need more of the path to wp-admin in your rule if you want to do this in the Directory context (like ^$|/)). The simple/naive fix would be to change your regex to ^.*wp-admin($|/) and just match anything that contains wp-admin (which is also a good way to verify that the rule itself is being parsed).

If you insist on pursuing this avenue of "security" though I would advise making this change in the VirtualHost context (or /wp-admin/.htaccess file) instead of in the Directory context for your whole server. It is both simpler to write and more robust. (Your current solution breaks if someone on your server DOESN'T want their wordpress admin page locked down (and there are probably a lot of people who won't -- anyone with a dynamic IP for example). Doing this in each VirtualHost or a .htaccess file allows you to keep certain sites "unlocked".)

share|improve this answer
Hope I found what i need. This works for me if below block inserted in httpd.conf context <Directory /usr/local/www/apache22/data/*/wp-admin> RewriteCond %{REMOTE_ADDR} !^77\.120\.9\.3$ RewriteRule . [R=404,L] </Directory> I saw this in Rewrite redirects examples and adapted to serve 404 error, but initially it was intended to do redirection. – Demontager Sep 28 '13 at 16:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.