Unfortunately a Password Protected post uses the wp-login.php file to process the password authentication for a post. So your Apache snippet of blocking all but those specific IPs is going to apply to anything that is password protected as well.
You can get nerdy and read code. In here you can see that Post Password form’s action is set to run that data through wp-login.php?action=postpass
So that is the bad news, BUT:
I wonder if trying to open that up so that your other files in WP can access those files? (I am just purely guessing at this point)
# Block access to wp-login.php.
<Files wp-login.php>
order deny,allow
allow from 192...(ip)
allow from 192...(ip)
allow from localhost
allow from 127.0.0.1
deny from all
I hope that helps or gives you some insight!
Related Posts:
- Improve wordpress security by hiding non public resources
- Does this .htaccess security setting really work?
- File and directory permissions
- Using “wordpress_logged_in” to restrict direct access to uploads folder in 2021
- WordPress URL/Folder ReWrite using Htaccess
- Which WordPress scripts need to be executable for a fresh installation?
- Blocking access to wp-login via htaccess not working
- Attach to wp-login.php and xmlrpc.php
- XMLRPC filtering through htaccess not working
- Restricting user login by IP address
- .htaccess password protect all but one page
- WordPress: Adding Security
- How do I test to ensure that my wp-config file is protected?
- WordPress not seeing .htaccess rules
- Rules in .htaccess only if the requested URL is /wp-admin
- Disable directory browsing of uploads folder
- Strange behaviour of is_user_logged_in() and get_current_user_id()
- Selectively Disabling PHP via .htaccess in Root Directory
- Should I prevent access to .htaccess and wp-config.php files?
- Basic Auth .htaccess on wp-login, but allow logout from woocommerce
- Using htaccess to prevent spam through wp-comments-post.php
- How can I create a private site that is inaccessible from the outside?
- Restrict Content for only Contributors via .htaccess
- Allowing access to certain WordPress created pages or posts with htaccess / htpasswd
- My WP site and password was hacked, what to do? [closed]
- Security headers disappear on WordPress pages
- Why is this line of code Wrong in every WordPress .Htaccess security article?
- How to redirect all HTTP requests to HTTPS
- Best collection of code for your .htaccess file [closed]
- Default .htaccess file for WordPress?
- Where to securely store API keys and passwords in WordPress?
- Which one does WordPress prioritize when it comes to php.ini, wp-config and .htaccess?
- Why are passwords exportable as plain text in WordPress?
- Security and .htaccess
- Enforcing password complexity
- WordPress site hacked. Has .htaccess been hacked?
- multi page password protection
- htaccess problem after saving Settings
- Protecting direct access to PDF and ZIP unless user logged in (without plugin)
- Stop WordPress and Plugins from Overwriting .htaccess
- How is password strength calculated?
- Change Login URL Without Plugin
- htaccess disable WordPress rewrite rules for folder and its contents
- htaccess rewrite conflict with wordpress rules and ssl
- htaccess https redirect from www to non-www
- What does a security risk in a plugin look like?
- Htaccess for Wordpess set on single subdomain
- Securing wp-admin folder – Purpose? Importance?
- adding rewrite rules in .htaccess
- .htaccess and 500 error, extra character added
- Name-based virtual host configuration in Apache seems to cause a “500 Internal Server Error”
- Place static HTML files in path below WordPress page
- Make password invalid once logged out of password-protected page
- Static raw HTML page
- WordPress + Magento .htaccess ReWriteRule Issue (www vs. non-www)
- Plugin to edit htaccess file
- Setting WP Admin passwords to expire
- htaccess rewrite for author query string when WP is in subfolder
- Why “Settings->Permalinks” creates .htaccess file on nginx server?
- .htaccess for wordpress inside another wordpress install
- .htaccess file redirecting to parent directory
- Blog.php or how to display recent posts?
- Options for restricting access to wp-admin
- Rewrite /?rest_route=/ link to /wp-json/ without changing default permalink structure in apache
- Globally force SSL on all pages
- Serve apache 404 for missing assets rather then wp 404 template WP_Rewrites
- Isolating WordPress to a subfolder
- Remove year and month in URL using .htaccess
- index.php not loading in main folder of wordpress
- Admin-Ajax.php, SSL, Non-SSL
- How to Block Access to Standard Login Flow and Comment Flow
- How disable SSL redirect for specific URL?
- WordPress site displaying 404 for any page apart from index
- Which ways can be used to log in to WordPress?
- Why does the header set X-Robots-Tag apply to all pages?
- Permalinks not working on second wordpress installed in a subdirect
- How to avoid wordpress permalink rules to inherit in a sub-folder
- How to change “wp-admin” to something else without search-replacing the core?
- Error:406 not acceptable
- Unable to access WP admin
- .htaccess Rewrite URL WordPress
- Move wordpress to folder without changing urls
- Rewrite rule not working
- Can’t reset WordPress password
- A plugin changes my .htaccess file and I can’t access httpd.conf as that’s a shared server
- Cant block wordpress readme files
- Change wp-content without changing the name of the folder
- 404/500 error on /wp-json
- WordPress keeps deleting .htaccess file
- Correct htaccess to display page while also passing in GET parameters
- What is the role of .htaccess file in WordPress?
- Is the “lost password” feature truly a vulnerability?
- Using WordPress only for the backend, and using AngularJS as a frontend
- Temporary .htaccess blocking is disabling WP Crons from running?
- Block access to wp-admin
- How to restrict access to wp-content, wp-includes and all sub-folders
- Two domains on one WordPress Installation
- .htaccess redirects disappeared after re-saving permalinks
- Protect Upload Folder Files With Ampersand Problem
- How have I misconfigured basic auth for my wordpress site?