Beginner's Guide for WordPress / Start your WordPress Blog in minutes

How to Limit Access by IP to Your wp-login.php file in WordPress

Not too long ago, we showed you how and why you need to limit login attempts in WordPress. Shortly after pushing that article, we started seeing an influx in attacks on our site. We had 39 lockouts from various IP addresses in a matter of few hours. Not sure whether it was people who just wanted to test this plugin out so they started to do failed attempts on our site, or whether it was real hackers. As a security measure, we decided to limit access by IP to our wp-login.php file in WordPress. We already have our WP Admin directory on limited access by IP. In this article, we will show you how to limit access by IP to your wp-login.php file in WordPress.

Note: This tutorial is not for total beginners.

Open your main .htaccess file and put this code towards the top of the file before everything else.

<Files wp-login.php>
        order deny,allow
        Deny from all

# whitelist West Palm Beach IP address
allow from xx.xxx.xx.xx

#whitelist Gainesvile IP Address
allow from xx.xxx.xx.xx

</Files>

Don’t forget to replace the IP addresses with your own. The only real downside to this is if you have dynamic IPs, then it can be a problem. Otherwise, this works like charm. Also, the wp-login.php styling breaks, but that is not a priority at this moment. We just wanted to prevent the failed login attempts.

For additional admin security, check out our article on 13 vital tips and tricks to protect WordPress admin area.

Disclosure: Our content is reader-supported. This means if you click on some of our links, then we may earn a commission. See how WPBeginner is funded, why it matters, and how you can support us.

The Ultimate WordPress Toolkit

Get FREE access to our toolkit – a collection of WordPress related products and resources that every professional should have!

Reader Interactions

23 CommentsLeave a Reply

    • You may want to ensure you set the correct IP and if you are using a VPN or something similar that may be the root of the issue

      Admin

  1. I used the above code and it somehow apply’s to every page of the site for example my home even shows prohibited.

    • You may first want to check with your hosting provider to ensure there isn’t a conflicting setup on their end.

      Admin

  2. Good One guys,
    As you stated in the last section, I do have dynamic IPs for my mobile connection. Though I have white listed my Broadband IP, getting stuck while accessing on the go.
    Do you know if any plugins help to solve this ?

    • Also, such requests to wp-login.php are getting redirected to the homepage. Is this normal ?

  3. Hmm it seems like your blog ate my first comment (it was super long) so I guess I’ll just sum it up what I wrote and say, I’m thoroughly enjoying your blog. I too am an aspiring blog blogger but I’m still new to the whole thing. Do you have any helpful hints for newbie blog writers? I’d genuinely appreciate it.

  4. We have made our ftp accessable only by certain IP.
    Now I can’t install or update wordpress directly via wordpress…
    What can I do?

  5. Great tips and works for me.
    But, Can i redirect wp-login to error 404?
    If can, what code i add into code above?

    thanks

  6. It’s very simple to find out any matter on net as compared to textbooks, as I found this post at this website.

  7. If you want to add more than one IP you can do this:

    1. you can use a partial IP:

    Allow from 145.50.39

    This will allow IP from 145.50.39.0 to 145.50.39.255

    2. you can use a netmask or a CIDR:

    Allow from 145.50.39.0/255.255.255.224

    or

    Allow from 145.50.39.0/27

    This will allow IP from 145.50.39.0 to 145.50.39.31.

  8. I added the code to my .htaccess but when my users logout they receive Error 403.
    When they click logout the link is /wp-login.php?action=logout

    Anyway to fix this?

  9. Great Tip! But i got a problem. It locks admin login from others ips, but if a registered user sign out from site, code also restricts that. I mean when user click sign out, it gives forbidden message. How to solve it?

  10. Thanks for your quick guideline to protect from excessive and illegal log in attempts. Actually there is a free plugin “better wp security” that can manage nearly all security issues regarding,login attempts,wp.config file,.htaccess file and many more. I think one should give it a try.

  11. Thanks for this great tip ! But i’m a but confused : should I paste this snippet in my root .htacess file, or into my wordpress/.htaccess file ?

    Cheers (and btw, I just LOVE wpbegginer.com, keep up the good work !)

  12. With dynamic IPs this can be a pain. You can set Apache Protect on it, but that is a bit more complex. #whitelist line is just to let me know which IP is which.

    Admin

Leave A Reply

Thanks for choosing to leave a comment. Please keep in mind that all comments are moderated according to our comment policy, and your email address will NOT be published. Please Do NOT use keywords in the name field. Let's have a personal and meaningful conversation.