If you are a website administrator, security should be at the top of your list. That’s why your first step should be to work with InMotion’s WordPress Hosting team to get your website up and running. After that, you can lock down the WordPress admin login with some .htaccess rules to prevent unauthorized login attempts.
How to Locate Your .htaccess File in cPanel’s File Manager
This guide will show how you to limit WordPress admin login attempts by IP address, or referrer. Below we’ll show you, how to get to your .htaccess file, and what edits to make, to limit WordPress admin logins. But first, we’ll show you how to find your .htaccess file in the cPanel File Manager.
- Log into your cPanel.
- Find the Files category and click on the File Manager icon.
- Click Settings at the top right corner.
- Select the Document Root for your domain and check the box next to Show Hidden Files. Click Save.
- Right-click the .htaccess file and select the Edit option.
- If you have a text editor encoding dialog box pop up, simply click Edit.
How to Restrict WordPress Admin Access
The following rules should be placed at the very top of your .htaccess file.
Single IP Address Access
You can check your IP to get your computer’s IP address.
If you are using CloudFlare or a DNS level filtering service, this method won’t work, you’ll want to setup a secondary WordPress .htaccess password for protection instead.
To allow access from a single IP address, replace 123.123.123.123 with your own IP address:
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^123.123.123.123$
RewriteRule ^(.*)$ – [R=403,L]
Multiple IP Address Access
You can check your IP to get your computer’s IP address.
If you are using CloudFlare or a DNS level filtering service, this method won’t work, you’ll want to setup a secondary WordPress .htaccess password for protection instead.
To allow access from multiple IP addresses, replace 123.123.123.xxx with your own IP addresses:
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^123.123.123.121$
RewriteCond %{REMOTE_ADDR} !^123.123.123.122$
RewriteCond %{REMOTE_ADDR} !^123.123.123.123$
RewriteRule ^(.*)$ - [R=403,L]
Dynamic IP Address Access, Limit by Referrer
If your IP address changes, you can protect your WordPress site by only allowing login requests that come directly from your domain name. Simply replace example.com with your own domain name Most brute force attacks rely on sending direct POST requests right to your wp-login.php script. So requiring a POST request to have your domain as the referrer can help weed out bots.
RewriteEngine on
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_REFERER} !^https://(.*)?example.com [NC]
RewriteCond %{REQUEST_URI} ^(.*)?wp-login.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteRule ^(.*)$ - [F]
Wait at least 15-20 minutes, and try to log into your WordPress site again. If you try to access the WordPress dashboard within the 15 minute window of a block, this could extend the block longer.
It’s important to wait for the previous block to expire and be patient before attempting to access your WordPress site again. You should now be blocking unauthorized WordPress admin login attempts utilizing .htaccess rules.
