I want to protect all Wordpress admin interfaces (wp-login.php/wp-admin) in my server. To do this, I want to create a global config in Apache, asking for a fixed user/password (HTTP basic authentication), before reach the real WordPress login page. This will avoid overload PHP from password scan bots.

<FilesMatch "wp-login.php">
 AuthUserFile /etc/wordpress.passwd
 AuthType Basic
 require valid-user

Works, any file named wp-login.php will ask for the password.

But when I run in a Wordpress site, its .htaccess has some kind of "priority" over the global config. When I access wp-login.php I just receive a 404 error. If I remove/rename .htaccess, FilesMatch works, but I lost the "path mask" feature, that is necessary.

Wordpress .htaccess is:

RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

I'm looking for a way to FilesMatch directive has priority over the .htaccess (Rewrite module): ask for the password, not rewrite the URL (giving 404).

Any ideas?

  • Where exactly in the "global config" have you put these directives? The "404 error" you are seeing - is this a WordPress generated 404 or Apache?
    – MrWhite
    Dec 29, 2020 at 20:44
  • The global config is after the last VirtualHost entry. And the 404 error is from Wordpress. Note: the global config position does not seems to affect. I tried.
    – Arvy
    Dec 29, 2020 at 20:53

1 Answer 1



Wordpress .htaccess rewrites everything, including the ErrorDocument directives, that are used by HTTP Basic Authentication, 401 and 403 return codes. I had personalized SHTML files for ErrorDocument (default in cPanel servers). So, instead of ask for a password, it rewrites the HTTP headers, asking for the password and showing a 404 error page at same time, letting the web browser crazy.

To fix, I just forced the default ErrorDocument messages:

ErrorDocument 401 default
ErrorDocument 403 default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.