5 ms·

I use the following in my nginx configuration (inside the "server" block) to restrict access to the WordPress login page from two IP addresses (one is my static

I use the following in my nginx configuration (inside the "server" block) to restrict access to the WordPress login page from two IP addresses (one is my static IP at home and the other is the IP address of a VPN endpoint): location = /wp-login.php { allow x.x.x.x/32; allow y.y.y.y/32; deny all; }

iamjason89 12y ago
Was just about to recommend this. Supporting Wordpress everyday, I find this is the best way to combat the problem. Another option would be to add an additional password for the directory. For you apache guys, AuthType Basic AuthName "Authentication Required" AuthUserFile "/etc/htpasswd/.htpasswd" Require valid-user
- deanclatworthy 12y ago
  This is the approach I used to take also, before moving my site to Jekyll. You could also use fail2ban to prevent hammering of that URL.
- porker 12y ago
  Good tip. The other two changes I recommend are: 1. Disable PHP execution in the uploads directory (hmm, wonder if it'd work if I disabled it in the entire wp-content folder?). 2. Run PHP as a different user to the file owner. Both of these are to minimise damage when an extension is exploited by a hacker (if it hasn't happened to you yet, it will do) and to reduce the damage done to the server/site.
jahnu 12y ago
A bit of a pain if you need access from a mobile device. However, I guess it shouldn't be too hard to set up a secret page on a custom URL http://example.com/0f53c140-76da-11e4-9b73-0800279cfd99 http://example.com/0f53c140-76da-11e4-9b73-0800279cfd99 that would temporarily add the requesting IP to the white-list.
- Cthulhu_ 12y ago
  Or set up a VPN to your home address, probably safer than trying to log in via a possibly unsecured channel (most WP installations don't have HTTPS enabled, or maybe that's just mine)
- benbristow 12y ago
  There's a Wordpress plugin that I used to use. It sets up a hidden Wordpress admin page on the following URL: http://www.youramazingblog.co.uk/wp-admin/?key=value http://www.youramazingblog.co.uk/wp-admin/?key=value So you need to enter a key/value of your choosing in the URL before you can access the admin page. Works pretty well especially if paired up with a decent key/value.

iamjason89 12y ago

Was just about to recommend this. Supporting Wordpress everyday, I find this is the best way to combat the problem. Another option would be to add an additional password for the directory. For you apache guys, AuthType Basic AuthName "Authentication Required" AuthUserFile "/etc/htpasswd/.htpasswd" Require valid-user

deanclatworthy 12y ago
This is the approach I used to take also, before moving my site to Jekyll. You could also use fail2ban to prevent hammering of that URL.
porker 12y ago
Good tip. The other two changes I recommend are: 1. Disable PHP execution in the uploads directory (hmm, wonder if it'd work if I disabled it in the entire wp-content folder?). 2. Run PHP as a different user to the file owner. Both of these are to minimise damage when an extension is exploited by a hacker (if it hasn't happened to you yet, it will do) and to reduce the damage done to the server/site.

jahnu 12y ago

A bit of a pain if you need access from a mobile device. However, I guess it shouldn't be too hard to set up a secret page on a custom URL http://example.com/0f53c140-76da-11e4-9b73-0800279cfd99 http://example.com/0f53c140-76da-11e4-9b73-0800279cfd99 that would temporarily add the requesting IP to the white-list.

Cthulhu_ 12y ago
Or set up a VPN to your home address, probably safer than trying to log in via a possibly unsecured channel (most WP installations don't have HTTPS enabled, or maybe that's just mine)
benbristow 12y ago
There's a Wordpress plugin that I used to use. It sets up a hidden Wordpress admin page on the following URL: http://www.youramazingblog.co.uk/wp-admin/?key=value http://www.youramazingblog.co.uk/wp-admin/?key=value So you need to enter a key/value of your choosing in the URL before you can access the admin page. Works pretty well especially if paired up with a decent key/value.