{"id":9818,"date":"2026-06-07T16:43:41","date_gmt":"2026-06-07T14:43:41","guid":{"rendered":"https:\/\/mybox.com\/help\/?post_type=manual_kb&#038;p=9818"},"modified":"2026-06-08T09:36:22","modified_gmt":"2026-06-08T07:36:22","slug":"cum-sa-securizati-accesul-la-zona-de-administrare-wordpress-utilizand-htaccess","status":"publish","type":"manual_kb","link":"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-to-secure-access-to-the-wordpress-admin-area-using-htaccess\/","title":{"rendered":"Cum s\u0103 securiza\u021bi accesul la zona de administrare WordPress utiliz\u00e2nd .htaccess"},"content":{"rendered":"<div class=\"translation-block translation-block-merged\">\n<p class=\"wp-block-paragraph\">By default, the WordPress administration panel is accessible to anyone who knows the login URL. While WordPress already protects access with usernames and passwords, you can significantly increase security by restricting access to specific IP addresses using <code>.htaccess<\/code> rules.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This method is particularly useful if:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You manage the website from a fixed IP address.<\/li>\n\n\n\n<li>Only a small number of people require access to the administration panel.<\/li>\n\n\n\n<li>You want to reduce the risk of brute-force login attempts.<\/li>\n\n\n\n<li>You want to block unauthorized access before the login page even loads.<\/li>\n<\/ul>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Important<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This solution works best when you have a static public IP address. If your IP address changes frequently, you will need to update the rules whenever it changes.<\/p>\n<\/blockquote>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 ez-toc-wrap-left counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-to-secure-access-to-the-wordpress-admin-area-using-htaccess\/#How_It_Works\" >How It Works<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-to-secure-access-to-the-wordpress-admin-area-using-htaccess\/#Step_1_Find_Your_Public_IP_Address\" >Step 1: Find Your Public IP Address<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-to-secure-access-to-the-wordpress-admin-area-using-htaccess\/#Step_2_Protect_the_wp-admin_Directory\" >Step 2: Protect the wp-admin Directory<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-to-secure-access-to-the-wordpress-admin-area-using-htaccess\/#Step_3_Protect_the_Login_Page\" >Step 3: Protect the Login Page<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-to-secure-access-to-the-wordpress-admin-area-using-htaccess\/#Result\" >Result<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-to-secure-access-to-the-wordpress-admin-area-using-htaccess\/#What_Happens_If_Your_IP_Changes\" >What Happens If Your IP Changes?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-to-secure-access-to-the-wordpress-admin-area-using-htaccess\/#Additional_Security_Recommendations\" >Additional Security Recommendations<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-to-secure-access-to-the-wordpress-admin-area-using-htaccess\/#Summary\" >Summary<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_It_Works\"><\/span>How It Works<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<\/div>\n\n<div id=\"mybox-1220301256\" class=\"mybox-content mybox-entity-placement\"><div class=\"early-access-banner-inpost\">\r\n  <div class=\"banner-left-inpost\">\r\n    <div class=\"icon-box-inpost\">\r\n      <img decoding=\"async\" src=\"https:\/\/mybox.com\/help\/wp-content\/uploads\/2026\/02\/square-info-icon.svg\" alt=\"Info\">\r\n    <\/div>\r\n    <div class=\"text-box-inpost\">\r\n      <span class=\"label-inpost\"><span class=\"translation-block translation-block-banner-text\">Acces timpuriu<\/span><\/span>\r\n      <h4><span class=\"translation-block translation-block-banner-text\">Mai ave\u021bi nevoie de ajutor?<\/span><\/h4>\r\n      <p><span class=\"translation-block translation-block-banner-text\">Contacta\u021bi echipa noastr\u0103 de servicii pentru clien\u021bi.<\/span><\/p>\r\n    <\/div>\r\n  <\/div>\r\n\r\n  <div class=\"banner-right-inpost\">\r\n    <a href=\"https:\/\/panel.mybox.com\/helpdesk2\/v\/list\/\" class=\"banner-button-inpost\"><span class=\"translation-block translation-block-banner-text\">Trimite mesaj<\/span><\/a>\r\n  <\/div>\r\n<\/div><\/div>\n\n<div class=\"translation-block translation-block-merged\"><p class=\"wp-block-paragraph\">The protection is applied in two locations:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>The <code>\/wp-admin<\/code> directory.<\/li>\n\n\n\n<li>The <code>wp-login.php<\/code> login page.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Users connecting from unauthorized IP addresses will be denied access before WordPress processes the request.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Step_1_Find_Your_Public_IP_Address\"><\/span>Step 1: Find Your Public IP Address<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before creating the rules, determine the IP address that should be allowed access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can check your current public IP address at:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/dhosting.pl\/mojeip.html?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">What Is My IP?<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Make a note of the displayed IP address.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Step_2_Protect_the_wp-admin_Directory\"><\/span>Step 2: Protect the wp-admin Directory<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Connect to your hosting account using FTP, SFTP, or your preferred file manager.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Navigate to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wp-admin\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Create a file named:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.htaccess\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the file already exists, edit it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Add the following rules, replacing the example IP addresses with your own:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>AuthUserFile \/dev\/null\nAuthGroupFile \/dev\/null\nAuthName \"wp-admin security\"\nAuthType Basic\n\n&lt;LIMIT GET&gt;\norder deny,allow\ndeny from all\n\n# Home IP\nallow from 203.0.113.10\n\n# Office IP\nallow from 198.51.100.25\n\n# Additional trusted IP\nallow from 192.0.2.50\n\n&lt;\/LIMIT&gt;\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can add as many trusted IP addresses as needed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Step_3_Protect_the_Login_Page\"><\/span>Step 3: Protect the Login Page<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open the main <code>.htaccess<\/code> file located in your website root directory.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By default, this directory is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>public_html\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Add the following block at the very beginning of the file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;Files wp-login.php&gt;\norder deny,allow\ndeny from all\nallow from 203.0.113.10\n&lt;\/Files&gt;\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Replace the IP address with the address you want to authorize.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If multiple IP addresses need access, add additional <code>allow from<\/code> lines:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;Files wp-login.php&gt;\norder deny,allow\ndeny from all\n\nallow from 203.0.113.10\nallow from 198.51.100.25\nallow from 192.0.2.50\n\n&lt;\/Files&gt;\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Result\"><\/span>Result<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After saving both files:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Unauthorized visitors will not be able to access <code>\/wp-admin<\/code>.<\/li>\n\n\n\n<li>Unauthorized visitors will not be able to load <code>wp-login.php<\/code>.<\/li>\n\n\n\n<li>Login attempts from unknown IP addresses will be blocked before WordPress processes them.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This greatly reduces exposure to automated attacks and brute-force login attempts.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_Happens_If_Your_IP_Changes\"><\/span>What Happens If Your IP Changes?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If your internet provider assigns a new IP address:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Access to the WordPress administration area will stop working.<\/li>\n\n\n\n<li>You must update the IP addresses listed in the <code>.htaccess<\/code> files.<\/li>\n\n\n\n<li>FTP access remains available, allowing you to modify the rules if necessary.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For this reason, IP-based protection is most suitable for users with static IP addresses.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Additional_Security_Recommendations\"><\/span>Additional Security Recommendations<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For even stronger WordPress security, consider:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Using strong passwords.<\/li>\n\n\n\n<li>Enabling two-factor authentication (2FA).<\/li>\n\n\n\n<li>Keeping WordPress updated.<\/li>\n\n\n\n<li>Updating themes and plugins regularly.<\/li>\n\n\n\n<li>Limiting login attempts.<\/li>\n\n\n\n<li>Disabling file editing from the WordPress dashboard.<\/li>\n\n\n\n<li>Using a web application firewall (WAF).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Summary\"><\/span>Summary<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To restrict access to the WordPress administration panel:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Create an <code>.htaccess<\/code> file inside the <code>wp-admin<\/code> directory.<\/li>\n\n\n\n<li>Allow access only from trusted IP addresses.<\/li>\n\n\n\n<li>Add a second rule in the main <code>.htaccess<\/code> file to protect <code>wp-login.php<\/code>.<\/li>\n\n\n\n<li>Save the changes.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">With these rules in place, only users connecting from approved IP addresses will be able to access the WordPress login page and administration panel.<\/p>\n<\/div>","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"template":"","format":"standard","manualknowledgebasecat":[58],"manual_kb_tag":[441,566,1628,4768,4769,4770,4771,4772,229,429],"class_list":["post-9818","manual_kb","type-manual_kb","status-publish","format-standard","hentry","manualknowledgebasecat-web-applications-cms","manual_kb_tag-brute-force-protection","manual_kb_tag-strong-passwords","manual_kb_tag-htaccess-rules","manual_kb_tag-restrict-admin-access","manual_kb_tag-wp-admin-directory","manual_kb_tag-wp-login-page","manual_kb_tag-public-ip-address","manual_kb_tag-static-ip-address","manual_kb_tag-two-factor-authentication","manual_kb_tag-wordpress-security"],"_links":{"self":[{"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manual_kb\/9818","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manual_kb"}],"about":[{"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/types\/manual_kb"}],"author":[{"embeddable":true,"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/users\/1"}],"version-history":[{"count":1,"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manual_kb\/9818\/revisions"}],"predecessor-version":[{"id":9819,"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manual_kb\/9818\/revisions\/9819"}],"wp:attachment":[{"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/media?parent=9818"}],"wp:term":[{"taxonomy":"manualknowledgebasecat","embeddable":true,"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manualknowledgebasecat?post=9818"},{"taxonomy":"manual_kb_tag","embeddable":true,"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manual_kb_tag?post=9818"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}