I’m not sure why WordPress doesn’t allow you to change the URL for the admin and login pages, but they don’t. It seems to me that putting define ( ‘ADMIN_PATH’, ‘/wp-admin/’ ); in wp-config would be an easy and a good fix–but for whatever reason, they don’t and we are stuck with a security hole.

I will first review the methods that currently exist as workarounds to this problem that we shouldn’t have in the first place, and then will go on to detail my method which I hope is a little easier to setup and maintain.

Plenty of methods exist for preventing access to these files, but IMO they are all overly complex, annoying, or flawed.

IP Limiting

I’ve never been a fan of limiting access based on IP unless it is really sensitive data. My reasoning here is that my IP is not static and it is a huge PITA to log in to my server and update my IP to give myself access again. Another problem with this approach is that it prevents you from accessing your blog while you’re anywhere but home. This method is not a good option for preventing access to wp-admin.

A WordPress Plugin

I just don’t like this solution. This means that each time a request is made to wp-admin, the entire WordPress code system needs to be loaded and executed before a request is allowed or denied. Plus it represents yet another thing you have to worry about maintaining and another possible vector of attack if the plugin itself has any kind of security holes. And as WP security has started to grow up, plugin security problems have become an increasingly common method for gaining control of your blog. Thanks, but no thanks Mr. stealth login plugin.

.htaccess Limiting

This solution is on the right track. It is a single file you can drop into any WP installation that will prevent access. It requires zero maintenance and allows you to “set it and forget it”. The problem with his solution is that it uses a sledge hammer when you need a scalpel ;]

Also, as the author states, this method prevents the “Edit” shortcut links from working.

My Solution

A specially crafted .htaccess file will allow you to “login” to the wp-admin section of your site by providing a keyword in the URL. If the keyword is missing, the visitor is automatically redirected to the homepage. If the keyword exists, a cookie is set on the machine that will allow access to wp-login.php and /wp-admin/ as you normally would.

This method requires no extra effort on your part beyond the .htaccess file and no modification to the WordPress code or install whatsoever.

RewriteEngine On
# Is this a request for wp-login?
RewriteCond %{REQUEST_URI} ^/wp\-login\..*
# Check for the secret word
RewriteCond %{QUERY_STRING} .*REPLACE_ME_WITH_A_SECRET_WORD=.*
# Set a cookie, so that all future requests will be auto-authenticated
RewriteRule ^.* /wp-admin/ [cookie=REPLACE_ME_WITH_A_SECRET_WORD:true:REPLACE_ME_WITH_YOUR_DOMAIN:3600:/,R,L]
# Is this a request to the admin?
# comment out this line and you will be able to reach wp-login.php, but not anything in /wp-admin/ until you authenticate
RewriteCond %{REQUEST_URI} ^/wp\-login\..* [OR]
RewriteCond %{REQUEST_URI} ^/wp\-admin/.*
RewriteCond %{HTTP_COOKIE} !\bREPLACE_ME_WITH_A_SECRET_WORD\b
# Unathenticated, redirect to homepage with a disallowed indicator
RewriteRule ^.* /?disallowed=true [R,L]

Setup:

• Replace REPLACE_ME_WITH_A_SECRET_WORD (3 occurrences) with a secret keyword. For reasons I won’t go into here, it is a good idea to stick with a keyword that contains only letters, numbers and underscores.
• Replace REPLACE_ME_WITH_YOUR_DOMAIN (1 occurrence) with your domain name like so: .example.com (note the first period but no www, this allows the cookie to function on any subdomain of your website)
• Optional: Change /?disallowed=true is the path the unauthorized visitor will be redirected to. You could also set it to “/” or any other page on your website.
• Optional: cookie=REPLACE_ME_WITH_A_SECRET_WORD:true:REPLACE_ME_WITH_YOUR_DOMAIN:3600:/ – 3600 is the number of minutes the cookie will remain cached. Feel free to make it lower but I suggest you keep it on the high side so that you won’t time out while working on your blog.

Getting it working:

Put all that into a file called .htaccess and put it in the root of your WordPress install. There may already be an .htaccess file there.

If there is already a .htaccess file there (there probably will be):

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

!!!!! INSERT THE NEW CODE HERE !!!!!

</IfModule>
# END WordPress

Save that file and now you will now be a little more secure.

Accessing The Admin

Let’s assume you made your secret word “k1tt3ns”. To “login”, you would visit http://blog.example.com/wp-login.php?k1tt3ns=true

If the phrase matches the one you set up in your .htaccess file, you should see the wp-login.php page like normal. A cookie will also have been set that will keep you “logged in” for however many minutes you set. After the cookie expires, you will have to “login” again by visiting http://blog.example.com/wp-login.php?k1tt3ns=true again.

Go ahead and try to log in to this site: http://www.mawhorter.net/wp-login.php. You won’t be able to, and instead, you will be redirected to this post.

This method allows you to bookmark your login page like normal, and will keep bad people from easily accessing it.

Drawbacks:

Cookies must be enabled. I can’t think of any others? Anyone?

• Previous Entry: Simple Image Manipulation in PHP (Rotate, Resize, Crop, Flip and Mirror, Thumbnails square and regular)
• Next Entry: More examples of image manipulation with PHP