Question How do I protect wp-admin directory? Print

Answer : 

The wp-admin directory is the core control panel of your WordPress site. Because it is targeted frequently by bots and attackers, securing it is one of the most important steps in WordPress hardening.

GHFS Hosting provides several methods to protect your wp-admin folder using Plesk tools and .htaccess rules.

1. Protect wp-admin with Password Protection (Plesk)

This adds an extra login layer before the WordPress login screen.

Steps:

1. Log in to your Plesk panel

2. Go to Websites & Domains

3. Open File Manager

4. Navigate to:

5. Click the three dots (⋮) next to the folder

6. Select Password-Protect This Directory

7. Create a username and password

8. Save

Now visitors must enter this password before reaching the WordPress login page.

2. Restrict wp-admin to Specific IP Addresses (Advanced Security)

If you have a static IP, you can restrict access so only your IP is allowed.

Add this to .htaccess inside wp-admin:

Example:

If multiple IPs:

3. Deny Access to wp-login.php Except Certain IPs

To block attacks on the login page, protect wp-login.php using:

Place this in the .htaccess located in /httpdocs/:

4. Enable WordPress Limit Login Attempts (Plugin)

Install a security plugin such as:

• Limit Login Attempts Reloaded

• Wordfence

• iThemes Security

These plugins help block brute-force attempts.

5. Enable reCAPTCHA on Login Page

Many security plugins allow you to add Google reCAPTCHA to:

• wp-login.php

• Lost password form

• Registration form

This reduces bot attacks significantly.

6. Move wp-login.php (Optional)

Plugins like WPS Hide Login allow you to change:

to something like:

This does not replace other protections but adds another layer.

7. Disable File Editing from WordPress Admin

Add this line to wp-config.php:

This prevents hackers from editing theme and plugin files if they gain admin access.

8. When to Contact GHFS Hosting Support

Contact support if:

• Password protection is not working

• You accidentally blocked yourself

• Your .htaccess rules cause errors

• You want stronger server-level protection

• You see repeated brute-force attacks

Support can set up or restore your protection settings.