How can I restrict access to the WordPress Admin Login page, by IP address, without it affecting the Customer Logout process?
Multi tool use
How can I restrict access to the WordPress Admin Login page, by IP address, without it affecting the Customer Logout process?
I am working on an eCommerce WordPress website, where I would like to restrict access to the WordPress Dashboard login screen. The restriction being that the Login page redirects to a 404.php file, for all IP addresses, other than those stipulated within the .htaccess file.
404.php
.htaccess
To achieve this, I have entered the following code into the .htaccess file:
.htaccess
ErrorDocument 401 /path-to-your-site/index.php?error=404
ErrorDocument 403 /path-to-your-site/index.php?error=404
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^xxx.xxx.xx.xxx$
RewriteCond %{REMOTE_ADDR} !^xxx.xxx.xx.xxx$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>
I then ensured that the above mentioned .htcaccess file was placed within the root folder.
.htcaccess
The above achieved what I was looking for, with one hitch ...
The website's shopping functionality is powered by WooCommerce. Visitors are able to create their own Customer Accounts. To problem, with the above code, becomes apparent when a Customer attempts to log out. Instead of being redirected to the Log Out/Registration page, they are redirected to the 404.php file; as per the above code.
404.php
Is there anyway I can modify the above code, so that the IP restriction remains for the WordPress login page, whilst Customer Account log outs not being affected?
Thanks for your quick reply. My knowledge, with the
.htaccess file is limited. Are you saying I would need to create a different landing page for WooCommerce Customer Logouts and then integrate this, into this .htaccess script?– Craig
5 hours ago
.htaccess
.htaccess
No, I am saying the logout URL WP creates is of the form
wp-login.php?action=logout&_wpnonce=..., so you could try and check for action=logout and let those requests through.– CBroe
5 hours ago
wp-login.php?action=logout&_wpnonce=...
action=logout
Ok. Some further learning needed in how to implement this but thanks for the helpful directive.
– Craig
5 hours ago
You’re gonna need a RewriteCond to check for query string contents, see stackoverflow.com/questions/2252238 (And since your logic is already set up to block on certain conditions, you might want to turn what I said last the other way around - and simply check whether the query string does not contain
action=logout, and in that case keep blocking. Easier than implementing “and let those requests through” in the above setup you already have.)– CBroe
5 hours ago
action=logout
1 Answer
1
Try this
Add this line your .htaccess file.
<Files wp-login.php>
order deny,allow
Deny from all
# allow access from my IP address
allow from 168.98.10.2
# allow access from my IP address
allow from 168.98.10.6
</Files>
By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.
WP handles the logout via that same script, so at most you could differentiate between different query string parameters …
– CBroe
5 hours ago