0

I have a "rule" in httpd.conf to pop-up a windows if somebody tries to access wp-admin section of any domain where wordpress is installed. With this rule I prevent boots for accessing wp-admin folder and to stop brute forces attacks.

# BEGIN BLOCK-WP-ADMIN-ATTACK

<Files wp-login.php>
AuthType basic
AuthName "EN: Human Check - U: human P: letmein"
AuthBasicProvider file
AuthUserFile /home/wp-admin-attack-htpasswd-file
Require valid-user
ErrorDocument 401 "<center><h1>Warning!</h1>You failed to authenticate.<p><br />Extra security has been temporarily enabled due to an ongoing attack against Wordpress logins on this server.<br /> <b>If you are a real user, please refresh the page and enter the username and password that are provided on the pop-up.</b><p>If you are still having troubles, please contact your hosting provider.</center>"
</Files>

# END BLOCK-WP-ADMIN-ATTACK #

This rule is working as it should but now I want to "allow" a domain so this rule will not apply for that domain.

0
1

I think you should be able to use SetEnvIf to do this. This is untested but might point you in the right direction:

# set env ALLOWED if hostname is either example.com or
# the client ip is 192.168.0.1
SetEnvIf Host example\.com ALLOWED
SetEnvIf Remote_Addr 192.168.0.1 ALLOWED

# if ALLOWED is not set display the password prompt
<IfDefine !ALLOWED>
  <Files wp-login.php>
    AuthType basic
    AuthName "EN: Human Check - U: human P: letmein"
    AuthBasicProvider file
    AuthUserFile /home/wp-admin-attack-htpasswd-file
    Require valid-user
    ErrorDocument 401 "<center><h1>Warning!</h1>You failed to authenticate.<p><br />Extra security has been temporarily enabled due to an ongoing attack against Wordpress logins on this server.<br /> <b>If you are a real user, please refresh the page and enter the username and password that are provided on the pop-up.</b><p>If you are still having troubles, please contact your hosting provider.</center>"
  </Files>
</IfDefine>
1
  • i tried it and it didn't worked for me (apache 2.4) – Froggiz Nov 10 '15 at 9:27
0

I would stick to satisfy any. This is a working proof-of-concept:

<Files wp-login.php>
            Satisfy Any

            Order deny,allow
            Deny from all
            Allow from example.org

            AuthType basic
            AuthName "EN: Human Check - U: human P: letmein"
            AuthBasicProvider file
            AuthUserFile /home/wp-admin-attack-htpasswd-file
            Require valid-user
            #ErrorDocument here
</Files>
0

you can use the satisfy any instruction

<VirtualHost *:80>
# [ Server Domain ]
ServerName the.domaine.allowed
# [ Server Root ]
DocumentRoot /var/www/
# [ Pass Through Auth]
<Files wp-login.php>
satisfy any
</Files>    
<VirtualHost>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.