0

I'm trying to restrict access to the wp-login.php file of a wordpress installation to a single IP address using the following .htaccess directive:

<Files wp-login.php>
    order deny,allow
    allow from y.y.y.y # Actual IP address replaced
    deny from all
</Files>

This works but it's also Denying access to wp-login.php files within the /public_html/subdomains directory. I've tried wrapping the Files directive inside a Directory directive like so:

   <Directory />
    Order allow,deny
    <Files wp-login.php>
       Order deny,allow
       allow from y.y.y.y
       deny from all
    </Files>
   </Directory>

But this just gives me a 500 Internal Server Error. I've also tried replacing the / in the Directory match with /public_html to no avail

Is there a way I can get the FilesMatch directive to only match the /public_html/wp-login.php file and not those inside the subdomains directory?

0

The problem you're encountering is cause by

The directives given within this section will be applied to any object with a basename (last component of filename) matching the specified filename.

So your files directive will match anything ending in wp-login.php.

The solution is to wrap it in a <Directory> block to limit it's scope

<Directory /path/to/wp-login>
    <Files wp-login.php>
        Order deny,allow
        allow from y.y.y.y
        deny from all
    </Files>
</Directory>

FWIW duosecurity have an integration that adds two factor auth to WP logins. It works really well.

4
  • This won't work. The FilesMatch directive works in the same way as Files in that it only compares the basename of the file, not the directory
    – Andy
    Feb 3 '14 at 10:25
  • A Directory directive cannot be placed inside .htaccess files
    – Andy
    Feb 3 '14 at 10:59
  • @Andy: Why are you doing this in a .htaccess file then - use the main server config.
    – user9517
    Feb 3 '14 at 11:00
  • 1
    I don't have access to the server config, it's on a shared server. I did say I was using the .htaccess file in my question. I think my only option is to move the subdomains out of the public_html directory. Thanks anyway
    – Andy
    Feb 3 '14 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.