Password protecting the wp-admin directory
Several places recommend to block the WordPress admin area with a password. While this certainly is a good idea, implementing it properly is non-trivial.
One of the problems is that the WordPress Ajax handler script is located in the admin directory. So password-protecting the admin area will break all Ajax functionality your blog might be using on the frontend.
First, see this tutorial on how to password protect directories with an .htaccess file. Sivel has an example for whitelisting the Ajax handler, add these line to your .htaccess file:
# These are the lines that do the password protection.
# You probably already created them while reading through the tutorial linked above.
AuthUserFile /path/to/your/htpasswd
AuthType basic
AuthName "Restricted Resource"
require valid-user# This is the whitelisting of the ajax handler
<Files admin-ajax.php>
Order allow,deny
Allow from all
Satisfy any
</Files>
Please notice that you absolutely need to create the htpasswd file, see the linked tutorial above.
Update: /wp-admin/css/install.css is also sometimes needed on the frontend, you should whitelist that as well.Here's the necessary configuration to whitelist a file in a password protected location in lighttpd:
$HTTP["url"] =~ "^\/wp-admin\/.*" {
$HTTP["url"] !~ "^\/wp-admin\/(admin-ajax\.php|css\/.*)" {
auth.require = (
"" => (
"method" => "basic",
"realm" => "Password protected area",
"require" => "user=theuser",
),
),
},
},
I am Nicolas Kuttler, a web developer, system administrator and IT consultant from France, currently living in Germany.
Just to note: I'm not on HostGator, and I didn't even bother to create the myerror.html page, and it still worked. Now I can log into the /wp-admin directory again with the added layer of security provided by htaccess password-protection. :)
I haven't played around with them or the undocumented(?) WP_CACHE but thought I should at least put the flag up in case anyone had any strange problems...
Aaaah, the usual wp mess :-)
I'm on a shared hosting account with Go Daddy. There is no way to access a folder above my shared accounts root folder. I have contacted them about adding the additional lay of protection to the wp-admin file but all I get back is that the directory is already protected and adding the additional layer of protection is not available on this file.
Now this might be poor customer service or some server configuration that they are not willing to expound upon, but I think I can get this done.
I've created a htpasswd file and added directive to the htaccess file. The article you link to states that the htpasswd file should be placed above the root directory on the server. That is not possible on a shared account with Go Daddy. Can I use file permissions to lock down the password file? Can I lock down this directory further given the shared hosting or do I have to upgrade to a dedicated server to allow for additional security measures such as this technique?
Thank you for this article. It is the most thorough article I've found on this subject.