Restrict wp-admin access in WordPress

In a WordPress installation, even with a strong password configured for wp-admin, we may want to prevent anyone from accessing this page, even if they do not know the password, whether to prevent exploits, hacks, or simply to prevent access from IPs other than your own.

There are different methods for restricting access to this directory: 

• Restrict access using an .htaccess file
  By including a few lines in your main .htaccess file, you can restrict which IPs have access to the directory. If you add the code shown below, with the IP of your access terminal (the PC from which you will access this section), you will block all access except from the specified IP:

  <Files wp-login.php>
   Order Deny,Allow
   Deny from all
   Require ip xxx.xxx.xxx.xxx
   </Files>

  Note

  Remember that you must replace xxx.xxx.xxx.xxx with the IP from which you will access it.
  You can allow additional access by adding more lines with the same content, Allow from xxx.xxx.xxx.xxx, if needed

  Once the changes are saved, you need to create an .htaccess file in the directory wp-admin, if it does not exist, and specify the following code:

  Order Deny,Allow
  Deny from all
  Require ip xxx.xxx.xxx.xxx

  Once these steps are completed, all access from IPs other than those specified will have been blocked. 

• Restrict access using plugins
  You can block access by IP or by user using WordPress plugins, such as WP Secure.

• Restrict access using .htaccess and .htpasswd
  Another method is to block access using .htaccess and .htpasswd. Our article explains how to password-protect directories with .htpasswd, which will complement the access restriction using .htaccess, discussed earlier, to secure wp-admin.

There are other methods for restricting access to wp-admin, but these are generally the most commonly used. Of course, these methods can be used to restrict access to any of the directories.