OK, First let me say that your entire premise is flawed: There are many other ways besides the presence of /wp-admin
to determine that you're using Wordpress. You're attempting Security through Obscurity, and since you're not obscuring everything you aren't doing a particularly elegant job of it.
Those inherent problems aside, at a quick glance your RewriteRule
seems to be wrong.
Per the Apache documentation:
What is matched?
In VirtualHost context, The Pattern will initially be matched against the part of the URL after the hostname and port, and before the query string (e.g. "/app1/index.html").
In Directory and htaccess context, the Pattern will initially be matched against the filesystem path, after removing the prefix that led the server to the current RewriteRule (e.g. "app1/index.html" or "index.html" depending on where the directives are defined).
Simply put that means you need more of the path to wp-admin
in your rule if you want to do this in the Directory
context (like ^domain.com/wp-admin($|/)
). The simple/naive fix would be to change your regex to ^.*wp-admin($|/)
and just match anything that contains wp-admin
(which is also a good way to verify that the rule itself is being parsed).
If you insist on pursuing this avenue of "security" though I would advise making this change in the VirtualHost
context (or /wp-admin/.htaccess
file) instead of in the Directory
context for your whole server. It is both simpler to write and more robust. (Your current solution breaks if someone on your server DOESN'T want their wordpress admin page locked down (and there are probably a lot of people who won't -- anyone with a dynamic IP for example). Doing this in each VirtualHost
or a .htaccess
file allows you to keep certain sites "unlocked".)
Allow
/Deny
rules) adequate?