The best way to block access is in the pre_virtualhost.conf or your equivalent httpd configuration file.
This code will block any access to yourdomain.com/wp-admin and redirect to a blank page with message, “Denied”. However, it will not block anyone trying to access yourdomain.com/somefolder/wp-admin.
<Location /wp-admin>
order deny,allow
Deny from all
allow from localhost 127.0.0.1 207.58.143.240
ErrorDocument 403 "Denied."
</Location>
I would advise familiarizing yourself with mod_rewrite.c, which allows you to set explicit conditions with incredible flexibility.
Related Posts:
- After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What’s the best solution now?
- How to redirect all HTTP requests to HTTPS
- What’s the best approach for generating a new API key?
- Simplest two-way encryption using PHP
- How does the SQL injection from the “Bobby Tables” XKCD comic work?
- how fix “this certificate cannot be verified up to a trusted certification authority”
- How can bcrypt have built-in salts?
- Getting a List of Currently Available Roles on a WordPress Site?
- Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php
- How safe / sanitized is wp_insert_posts()?
- From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
- Why are passwords exportable as plain text in WordPress?
- How to set up fail2ban with WordFence?
- Is there a way to force ssl on certain pages
- What is the purpose of having a token in cookies?
- How is password strength calculated?
- How to fake a WordPress login?
- Regular security checks – what steps should be included?
- What are the pros and cons of using a custom front-end to retrieve content from a WordPress back-end
- WordPress “Site Health Status” trust it or myself for its security advice?
- Do Cookies Need to be Sanatized Before Being Saved?
- Is WP vulnerable when updating plugins or themes?
- Disable external access to REST API Endpoint
- What is the wp-includes/certificates/ca-bundle.crt used for?
- Do you need to escape hard coded plain text?
- Encrypt emails?
- Garbage in beginning of wp-config.php – was this WP installation compromised?
- WordPress salts set in config and database
- Disallow file edit not preventing plugin install
- How to secure WordPress XMLRPC?
- What is the relationship between cURL, WordPress and cacert.pem?
- How can I find security hole in my wordpress site?
- Does WP show me if I’m logged in from multiple locations?
- Is it necessary to use esc_url with template tags such as get_permalink?
- How to prevent bot or someone to modify any file automatically?
- WordPress Malware Problem help! [duplicate]
- Staging Site: Made Public – Security Questions
- Best Way to Enable Two Step Authentication
- Restrictive File Permissions
- Why are xmlrpc.php and wp-cron.php being called so often?
- Using esc_html with HTML purifier and CSSTidy: Overkill?
- wordfence scan warning on W3 Total Cache [closed]
- Securing a multi-user permission structure
- Is default functions like update_post_meta safe to use user inputs?
- No option “I would like my site to be private, visible only to users I choose” in Privacy Settings
- FORCE_SSL_ADMIN not working
- wp-config.php modified?
- Suspicious Files
- How to save iframe tag into a post?
- wp-json and what data does it give away?
- Is is necessary to use security plugin for wordpress? [closed]
- neccessary?
- my wordpress website is suspended [closed]
- Is wp_kses the right approach in sanitizing this string?
- iTheme Security always lockout my account [closed]
- Is it sensible to worry about sanitizing admin input in plugin custom CSS?
- Renaming install.php for security?
- WordPress Front end Form – Enable to Submit PHP Codes
- Is it safe use wp_editor in public contact form
- Is WordPress MultiSite secure & how much can it scale? [closed]
- Which Versions of WordPress Ship with the Patched TimThumb?
- Use global variables or function that returns said variables for site-wide private-ish WP settings?
- How safe is current_user_can()?
- Is it safe to give wordpress directories ownership to www-data?
- Use Google authentication for pages within a website [closed]
- Why does WordPress change a file’s permissions?
- Side effects of disallowing *.php requests in production environment?
- should I escape a literal url added in functions.php
- Outgoing new connection to linked Websites – why?
- My Site keeps crashing due to the wp-confg file being deleted
- Someone keeps changing my SITEURL (mysql injection or xss?) [closed]
- Moving wp-config.php outside root folder where we have multiple wordpress websites for enhanced security [duplicate]
- Replace domain in database
- Adding Security Keys?
- What highest security brake with wordpress and static files?
- Secret keys in SCM
- Uploading attachment (pdf) and prevent download for anonymous user
- Specific Page/Post Need to Stay Non SSL
- Basic Auth .htaccess on wp-login, but allow logout from woocommerce
- how to add security questions on wp-registration page and validate it
- Scan multiple websites for malware that are in same webhost root?
- Security: AWS (shared hosting) claims template file malicious
- Cannot access wp admin of WordPress website (security plugin issue) [closed]
- Why are the latest visits to my website originating from my own website?
- PHP Code Sniffer – WordPress VIP Coding Standards
- How do I hide WordPress users from security scanning?
- Background Updates Not Happening
- wp-config.php file and code injection
- Able to go to WordPress admin even after deleting auth cookies from request headers
- FORCE_SSL_ADMIN affecting subdomains
- What is the best security $_POST method?
- Should WordPress Add Options to Enhance Security or Leave it to plugin developers? [closed]
- Bank account number and Sort Code in a form [closed]
- Directory to store secure file
- How can I give someone server access to only duplicate and modify a site?
- How can I implement ansible with per-host passwords, securely?
- Why should I firewall servers?
- Does drilling a hole into a hard drive suffice to make its data unrecoverable?
- Can you alter the default wordpress strong password requirements?
- how to sanitizing $_POST with the correct way?