WordPress yönetici dizininizi nasıl parola ile koruyacağınızı öğrenmek ister misiniz?
WordPress yönetici dizininize başka bir parola koruması katmanı eklemek, WordPress güvenliğinizi artırmanın harika bir yolu olabilir.
Bu makalede, wp-admin dizininizi nasıl kolayca parola ile koruyabileceğinizi öğreneceksiniz.
WordPress Yönetici Dizininizi Neden Parola ile Korumalısınız?
WordPress yönetici dizininizi parola ile koruyarak WordPress web sitenizin en önemli giriş noktasına ekstra bir güvenlik katmanı eklemiş olursunuz.
WordPress yönetici paneliniz sitenizin merkezidir. Yazıları ve sayfaları yayınlayacağınız, temanızı özelleştireceğiniz, WordPress eklentilerini yükleyeceğiniz ve daha fazlasını yapacağınız yerdir.
Bilgisayar korsanları web sitenize girmeye çalıştıklarında bunu genellikle wp-admin ekranı üzerinden kaba kuvvet saldırısı kullanarak yaparlar.
Güçlü bir parola ve giriş denemelerini sınırlama gibi güvenlik önlemleri kullanarak web sitenizi olası saldırılara karşı korumaya yardımcı olabilirsiniz.
Daha da güvenli olması için wp-admin dizinini de parola korumalı hale getirebilirsiniz. Böylece, birisi yönetici alanınıza erişmeye çalıştığında, WordPress giriş sayfasına ulaşmadan önce bir kullanıcı adı ve şifre girmesi gerekecektir.
Bununla birlikte, WordPress yönetici dizininizi adım adım nasıl parola ile koruyabileceğinize bir göz atalım.
Çoğu kullanıcı için ilk yöntem önerilir ve kullanmak istediğiniz yönteme doğrudan atlamak için aşağıdaki hızlı bağlantıları kullanabilirsiniz:
Video Eğitimi
Yazılı talimatları tercih ediyorsanız, okumaya devam edin.
Yöntem 1: Dizin Gizliliğini Kullanarak wp-admin’i Parola ile Koruyun (Önerilen)
WordPress yönetici dizininizi parola ile korumanın en kolay yolu WordPress barındırma sağlayıcınızın Dizin Gizliliği uygulamasını kullanmaktır.
Öncelikle, hosting hesabınızın kontrol panelinde oturum açmanız ve web sitenizin cPanel kontrol panelinin Dosyalar bölümündeki ‘Dizin Gizliliği’ seçeneğine tıklamanız gerekir.
Not: Bluehost gibi cPanel kullanan çoğu web barındırıcısı benzer adımlara sahip olacaktır. Ancak, barındırma sağlayıcınıza bağlı olarak kontrol paneliniz ekran görüntülerimizden biraz farklı olabilir.
Bu sizi sunucunuzdaki tüm farklı dizinleri listeleyen bir ekrana getirir. Web sitenizin dosyalarını içeren klasörü bulmanız gerekir.
Çoğu web sitesi sahibi için bu, ‘public_html’ klasörüne tıklayarak bulunabilir.
Bu, sunucunuza yüklediğiniz tüm web sitesi dosyalarını getirir.
Ardından, web sitenizin alan adının bulunduğu klasöre tıklamanız gerekir.
Bu klasörde bir wp-admin klasörü göreceksiniz.
Klasör adına tıklamak yerine, o klasörün yanındaki ‘Düzenle’ düğmesine tıklamanız gerekir.
Bu sizi parola korumasını açabileceğiniz bir ekrana getirir.
‘Bu dizini parola ile koru’ yazan kutuyu işaretlemeniz yeterlidir. İsterseniz, hatırlamanıza yardımcı olması için dizininize ‘Yönetici Alanı’ gibi bir ad da verebilirsiniz.
Bunu yaptıktan sonra, ‘Kaydet’ düğmesine tıklamanız gerekecektir.
Bu sizi onay mesajının görüneceği bir sayfaya götürecektir.
Şimdi, ‘Geri Git’ düğmesine tıklamanız gerekecek ve bu dizine erişebilecek bir kullanıcı oluşturabileceğiniz bir ekrana yönlendirileceksiniz.
Bir kullanıcı adı ve parola girmeniz ve ardından parolayı onaylamanız istenecektir. Kullanıcı adınızı ve şifrenizi, şifre yöneticisi uygulaması gibi güvenli bir yere not ettiğinizden emin olun.
Bunu yaptıktan sonra ‘Kaydet’ düğmesine tıkladığınızdan emin olun.
Şimdi, birisi wp-admin dizininize erişmeye çalıştığında, yukarıda oluşturduğunuz kullanıcı adı ve şifreyi girmesi istenecektir.
Yöntem 2: Kod Kullanarak wp-admin’i Parola ile Koruyun
WordPress yönetici dizininizi manuel olarak da parola ile koruyabilirsiniz. Bunu yapmak için .htpasswd ve .htaccess adında iki dosya oluşturmanız gerekir.
Not: WordPress sitenize herhangi bir kod eklemek tehlikeli olabilir. Küçük bir hata bile web sitenizde büyük hatalara neden olabilir. Bu yöntemi yalnızca ileri düzey kullanıcılar için öneriyoruz.
.htaccess Dosyasını Oluşturma
İlk olarak, tercih ettiğiniz metin düzenleyiciyi açın ve yeni dosyaya .htaccess adını verin.
Bundan sonra, aşağıdaki kod parçacığını kopyalamanız ve dosyaya eklemeniz gerekir:
AuthName "Admins Only"
AuthUserFile /home/user/public_html/example.com/wp-admin/.htpasswd
AuthGroupFile /dev/null
AuthType basic
require user yourusername
‘AuthUserFile’ yolunu .htpasswd dosyasını yükleyeceğiniz konum olarak değiştirdiğinizden ve ‘yourusername’ ifadesini oturum açmak için kullanmak istediğiniz kullanıcı adıyla değiştirdiğinizden emin olun.
İşiniz bittiğinde dosyayı kaydetmeyi unutmayın.
.htpasswd Dosyasını Oluşturma
Bunu yaptıktan sonra, bir .htpasswd dosyası oluşturmanız gerekir.
Bunu yapmak için bir metin düzenleyici açın ve .htpasswd adında bir dosya oluşturun. Bu dosya kullanıcı adınızı şifrelenmiş bir biçimde parolanızla birlikte listeleyecektir.
Şifrelenmiş parolayı oluşturmanın en kolay yolu bir htpasswd oluşturucusudur.
Kullanıcı adınızı ve parolanızı girmeniz, şifreleme biçimini seçmeniz ve ‘Create .htpasswd file’ düğmesine tıklamanız yeterlidir.
htpasswd oluşturucu, .htpasswd dosyanıza yapıştırmanız gereken bir metin satırı görüntüleyecektir. Bunu yaptıktan sonra dosyayı kaydettiğinizden emin olun.
.htaccess ve .htpasswd dosyalarının wp-admin Dizinine yüklenmesi
Son adım, oluşturduğunuz her iki dosyayı da web sitenizin wp-admin klasörüne yüklemektir.
WordPress barındırma hesabınıza bir FTP istemcisi veya barındırma sağlayıcınız tarafından sağlanan çevrimiçi dosya yöneticisi aracını kullanarak bağlanmanız gerekecektir. Daha fazla ayrıntı için WordPress’e dosya yüklemek için FTP’nin nasıl kullanılacağına ilişkin başlangıç kılavuzumuza bakın.
Bu eğitimde, ücretsiz olduğu ve hem Mac hem de Windows’ta çalıştığı için FileZilla ‘yı kullanacağız.
Web sitenize bağlandıktan sonra, soldaki pencerede bilgisayarınızdaki dosyaları ve sağda web sitenizdeki dosyaları göreceksiniz. Sol tarafta, .htaccess ve .htpasswd dosyalarını kaydettiğiniz konuma gitmeniz gerekir.
Ardından, sağ tarafta, korumak istediğiniz web sitesi için wp-admin dizinine gitmeniz gerekir. Çoğu kullanıcının public_html klasörüne, ardından alan adlarının bulunduğu klasöre ve ardından wp-admin klasörüne çift tıklaması gerekecektir.
Şimdi, soldaki iki dosyayı seçebilir ve sağ tıklama menüsünden ‘Yükle’ye tıklayabilir veya dosyaları soldaki pencereye sürükleyebilirsiniz.
Artık ‘wp-admin’ dizininiz parola korumalı olacaktır.
wp-admin Parola Koruması Sorunlarını Giderme
Sunucunuzun ve web sitenizin nasıl kurulduğuna bağlı olarak, WordPress hatalarıyla karşılaşma olasılığınız vardır. Bu hatalar .htaccess dosyanıza dikkatlice kod ekleyerek düzeltilebilir.
Not: Bu, ‘wp-admin’ klasörüne yüklediğiniz değil, ana web sitesi klasörünüzde bulunan .htaccess dosyasıdır. Bulmakta sorun yaşıyorsanız, .htaccess dosyasını neden bulamadığınız ve nasıl bulacağınızla ilgili kılavuzumuza bakın.
Ajax Çalışmıyor Hatasını Düzeltme
En yaygın hatalardan biri, Ajax işlevselliğinin sitenizin ön ucunda çalışmayı durdurabilmesidir. Canlı Ajax araması veya Ajax iletişim formları gibi Ajax gerektiren WordPress eklentileriniz varsa, bu eklentilerin artık çalışmadığını fark edeceksiniz.
Bunu düzeltmek için, aşağıdaki kodu wp-admin klasörünüzde bulunan .htaccess dosyasına eklemeniz yeterlidir:
<Files admin-ajax.php>
Order allow,deny
Allow from all
Satisfy any
</Files>
404 Hatasını ve Çok Fazla Yönlendirme Hatasını Düzeltme
Karşılaşabileceğiniz diğer iki hata 404 hatası ve çok fazla yönlendirme hatasıdır.
Bunları düzeltmenin en basit yolu, web sitenizin dizininde bulunan ana .htaccess dosyanızı açmak ve WordPress kurallarından önce aşağıdaki kod satırını eklemektir:
ErrorDocument 401 default
Bonus: wp-admin Güvenliği için En İyi WordPress Kılavuzları
Artık wp-admin dizininizi nasıl parola ile koruyacağınızı bildiğinize göre, yönetici alanınızı daha güvenli hale getirmek için bu kılavuzları görmek isteyebilirsiniz:
- WordPress Yönetici Erişimini IP Adresine Göre Kısıtlama
- WordPress Yönetici Alanınızı Korumak İçin Hayati İpuçları (Güncellendi)
- WordPress’te Özel Giriş URL’si Nasıl Eklenir (Adım Adım)
- WordPress’te Giriş Denemelerini Nasıl ve Neden Sınırlandırmalısınız?
- WordPress’te İki Faktörlü Kimlik Doğrulama Nasıl Eklenir (Ücretsiz Yöntem)
- WordPress Giriş Ekranına Güvenlik Soruları Ekleme
- WordPress’te Kullanıcıları Parola Değiştirmeye Zorlama – Expire Password
- WordPress’te Tüm Kullanıcıların Parolaları Nasıl Sıfırlanır
Umarız bu makale WordPress yönetici (wp-admin) dizininizi nasıl parola ile koruyacağınızı öğrenmenize yardımcı olmuştur. Ayrıca ücretsiz e-posta alanı edinme kılavuzumuza ve küçük işletmeler için en iyi e-posta pazarlama hizmetleri uzman seçimlerimize de göz atmak isteyebilirsiniz.
If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.
Syed Balkhi says
Hey WPBeginner readers,
Did you know you can win exciting prizes by commenting on WPBeginner?
Every month, our top blog commenters will win HUGE rewards, including premium WordPress plugin licenses and cash prizes.
You can get more details about the contest from here.
Start sharing your thoughts below to stand a chance to win!
Rauf says
Sir when i login the popup button appear again and agin asking for enter the username and password
demonkoryu says
Edit: I see that your problem isn’t with Disqus comments (facepalm), but it might be applicable in your case anyway.
This happened to me too.
a) Clear all cookies (for Disqus and the site where you’re trying to use it)
b) Try another browser than the one you’re currently using
Thomas says
This isn’t working for me in WordPress 3.9.1. I get a 500 (internal server) error for any admin pages, and the wp-login.php page loads but doesn’t display correctly.
I’ve added the code for the 404 error to the main .htaccess file, and have added the ajax code to the wp-admin/.htaccess file. No change.
What might be causing this? Is my server or WordPress install misconfigured somehow?
Abinash Mohanty says
Hi Syed, Thanks for the tips! I tried with Cpanel method and then added the following .htaccess scripts. The modal pop up window was not working previously and I realized that there was another usename, which was assigned for the same purpose in the past. So what I did was removed all previously assigned usernames and added a new one followed by the new password. The modal popup started working like a charm
Thanks a lot.
David says
Thank you! –
fixed my redirect loop issue with ErrorDocument 401 default
Guest says
I added the admin-ajax code to my /wp-admin .htaccess file, but that didn’t fix the issue. The All-In-One-Event-Calendar plugin is still not able to access the admin-ajax on the front end.
Please advise.
Thank you!
bamajr says
Wouldn’t adding 2-Step Authentication to the WordPress Admin, login process, resolve this? Say, by using Authy (and their associated plugin)!
WPBeginner Support says
Yes but an additional layer further strengthens security.
Yönetici
Chris Christoff says
Hi guys,
Quick note, admin-ajax.php isn’t the only thing that plugins need access to. You also need to allow non-password protected access to async-upload.php and media-upload.php
These are used by plugins to allow files to be uploaded on the frontend (like uploading a file during a checkout).
-Chris
bikramjit singh says
Hi….i m new to wordpress and regular visitor here.I am facing a problem.When I try to login to my wordpress panel,the panel to enter username and password does not come.The site opens itself.My domain is http://www.tradethetechnicals.com.How can settle this issue?
WPBeginner Support says
You can visit your login page here: http://tradethetechnicals.com/wp-admin
Yönetici
Abinash Mohanty says
Hi Syed Balkhi,
You made my day! I was getting regular attempts to hack by unknown sources. Thanks for the process, I have fixed mine. It’s better and way easier than wordpress codex
Kushal Jayswal says
Hi I am confused!
If I lock wp-admin directory then registered authors can access “http://site.com/wp-admin” in the browser? Or they also need username and password?
See on my blog anyone can login directly with Facebook, so in such a case if password and username is mandatory for all users. It will be little complex to handle…
Any comment?
WPBeginner Support says
your registered authors will need password to access WP Admin area.
Yönetici
Phil Alcock says
Thanks for the ajax fix. Added those few lines and it fixed my problem with a plugin. Much easier than the suggestion in the WordPress Codex.
Inayu Mustikayu says
i follow the manual tutorial and and with 500 error, after trial and error get this work with :
AuthUserFile /home/yourdirectory/.htpasswds/public_html/wp-admin/passwd
changed to just
AuthUserFile /home/yourdirectory/.htpasswds
in my small tiny ubuntu apache vps
aryan says
hello,
i use this password method ,
please help , because this popup windows not open in UCBrowser !!
so tell me may i make a page ,html page or any kind of page for login ?? i don’t want to show popup ,i want to show a login in page , and other function as same
WPBeginner Support says
You can create a custom login page for WordPress.
Yönetici
Chathu says
If I follow cpanel method, are there any way to remove the password?
Thanks!
Masood says
Thanks for sharing very help full
Arthur says
Wow! at last! The “ErrorDocument 401 default” did the trick. I was loosing my patience with the redirect problem….
Thank you so much for share that.
James says
Seems to work great except it asks for authentication on our home page not just when accessing wp-admin. Is this possibly another plugin calling a file other than admin-ajax.php?
Editorial Staff says
Yup it is very possible that another plugin is calling admin-ajax.php. You should use the fix mentioned above.
Yönetici
Jeffro says
Just wanted to let you know that when I went to manage my subscriptions here on the site via email link, I received the username password prompt. Clicking Cancel allowed me to manage my subscriptions. After selecting and option and clicking save, got the prompt again which clicking cancel also allowed the action to be performed. Just letting you guys know in case you did’nt want that to happen to other people.
Muhammad Ahsan says
shoud I copy the “ErrorDocument 401 default” line in .htaccess file in /wp-admin/.htaccess file ? or any other .htaccess file ?
Editorial Staff says
You would paste this in the main .htaccess file.
Yönetici
pankaj says
Hi ,
As you told i i did but when i open wp-admin directory then i got error like “The page isn’t redirecting properly
Firefox has detected that the server is redirecting the request for this address in a way that will never complete.
This problem can sometimes be caused by disabling or refusing to accept
cookies”.
Even in google chrome it doesn’t given popup.Can you tell me how to resolve this issue.
Thanks in Advance.
Editorial Staff says
You have to read the article section that says: Too many redirects error
Yönetici
Ed Emery says
Hi,
This problem has been going since day one last week when I first installed WP. I just did the step by step How to Password Protect Your WordPress Admin (wp-admin) Directory but same problem! Here is a screen shot of what / who / hacker is going on.
First this:
The server sacramentofan.com at WPBeginner Admins Only requires a username and password.
Warning: This server is requesting that your username and password be sent in an insecure manner (basic authentication without a secure connection).
Then this after trying to login:
The server sacramentofan.com at WordPress attack protection CAPTCHA. Enter username: e7en4d Password: The result of math 16+4 requires a username and password.
Warning: This server is requesting that your username and password be sent in an insecure manner (basic authentication without a secure connection).
So how do I stop this as I have tried everything since last Thursday 07-18-2013
Thanks,
Ed
Editorial Staff says
Too complex of an issue to explain by just hearing about it. Would really have to see what is going on. It seems that some plugin is causing this issue.
Yönetici
David McMahon says
Many thanks for this helpful hint – I’d been wondering why I kept getting the dreaded “request will never complete” message from Firefox, but now I don’t!
Akash Deep Satpathi says
Hi! I followed your tutorial with cPanel but after it I was not able to view my Dashboard. It was saying “This webpage has a redirect loop” on Google Chrome. So, what I am missing?
Editorial Staff says
Read the section that explains 404 error or too many redirects issue.
Yönetici
Meher says
Hi,
Thank You very much for your article.
I was trying to add an additional login layer to wp-admin folder and was redirecting to – Too many redirects error -.
I searched a lot in Google and came across your article. This really helped me solve this issue.
Thank you once again.
Dan says
Same problem here.
arman says
it works well
but there is one problem .
when normal users Login and wants to go to dashboard and change some info like picture profile they must answer this user password too !!
is there any chance to set this protected folder for only admin or ignore it for normal users dashboard ?
Editorial Staff says
No. You would have to do it for all users.
Yönetici
ARMAN says
So , If i use this for All users , it means all users must have my USer, password for Protected Folder !!
so anyone can register and Anyone must have this user , password then any hacker can register as User in my site and get this user & pass !!
So Protecting Wp-admin is useful for only sites with one Admin or with some Special Users to share this user password …
Editorial Staff says
You can create multiple users in .htpswd. You would have to use what is called a group.
fox says
ooohhh men thanks for your help :
ErrorDocument 401 default
works perfect !!!!!
Nishant says
Thanks for the tips. I have implemented password protection of Wp-Admin directory and also have added double authentication using Google Authenticator. It seems to work fine.
I recently migrated to a new host (Bluehost) and set up my WordPress site.
I have installed Wordfence security plugin. The configuration of the plugin is such that every time somebody logs in(including myself), I get an email alert. And also, if somebody attempts a login with an invalid username, then it locks out that IP Address for 10 minutes and sends an email notifying me that there has been a failed attempt to login.
Considering that I have password protected my Wp-admin directory, unless someone knows the user and and password for it, they cannot reach wp-admin or wp-login to attempt a login to my wordpress.
But last night I got few emails from Wordfence citing that there have been lock out of few IP Addresses for having made failed attempts to logon to WordPress using invalid usernames (like admin, Admin or nishant). Is it possible to bypass server side password protection of wp-admin directory and make an attempt to logon to WordPress?
Nishant
Nishant says
Also, I just noticed that…
When I use the URL directly to wp-login, i am shown the window of server side password for wp-admin directory. But when I click cancel on that password window(2 to 3 times), it displays the wp-login page!
But when the url is wp-admin, then when clickign cancel it displays “401 Authorization Required
Invalid login credentials!”
And the log files showed the invalid attmepts to login were tryign to access wp-login.php directly.
Editorial Staff says
Yes wp-login.php is still accessible. But even if they get the right password, they won’t be able to see it. You can also use the same technique and password protect your wp-login.php file individually.
Yönetici
Jeffro says
Just what exactly would that code be? I didn’t see an easy way to password specific files in Cpanel.
Bart says
Dear author,
I am convinced I followed all of your directives, yet still I get the Firefox “endless loop” notification. This is what I did so far:
– I made a .htpasswds file in /.htpasswds/public_html/wp-admin/passwd (CHMOD 664)
– I made a .htaccess file with a generated hash / username and put it in /public_html/wp-admin
– I inserted the line ErrorDocument 401 default before all code into my main .htaccess file in /public_html
Could you please guide me to solving this problem. My main questions are:
– you say “make a file called ‘.htpasswds’ “. Is this in fact the correct filename ? I mean, with the s at the end included?
– exactly what path do I need to specify in my .htaccess file in my /public_html/wp-admin folder? Currently it says “AuthUserFile /.htpasswds/public_html/wp-admin/passwd” I’m not sure I’m doing this part right…
I’m looking forward to some clarification here…I have been wrestling with this a couple of hours now and I figure it shouldn’t be THAT hard?
Thank you very much in advance…if you require any more info I’m more than happy to provide it. Kind regards,
Bart
Editorial Staff says
What type of hosting are you on? Do you have a cPanel web host? Can you try using the cPanel method to generate the htpswd file?
It’s really hard to tell what is going wrong because we wrote down the exact same thing that we did on our site.
Yönetici
zimbrul says
I’d like to ask you guys a question: did it ever happen to you to have admin folder password protected and to be asked for authentication for EVERY post you read on your blog? It does happen with one of my blogs. I was wondering if it’s not better to protect the admin login with Google Authenticator or something similar instead…
Editorial Staff says
If you are being asked to authenticate every single time, then one of the two is happening:
1. You pasted the .htaccess info in your main .htaccess file and not in the .htaccess file in the /wp-admin/ folder.
2. admin-ajax.php file is being loaded on the front-end. You need to add the rule to prevent that from being password protected. We have mentioned the fix for that.
Lastly, yes we have 3 layers of protection for our admin. IP match (if that doesn’t match, then the .htaccess password), and then there is Google Authenticator. We also have limit login attempts activated as well.
Sucuri also does a pretty good job at blocking other attacks.
Yönetici
Anish K.S says
i tried this method, but getting an error ” Error 310 (net::ERR_TOO_MANY_REDIRECTS): There were too many redirects. ”
How to fix this ???
Editorial Staff says
The article has a section about that. Did that not fix this issue?
Yönetici
Anish K.S says
Yes, I fixed It. thanks for the tutorial.
Mathieu Slaedts says
Hi there.
I try to implement this protection. I tried the two solutions (manual and form the admin panel of my host). In both case, the .htacess is in the wp-admin folder, but the pop-up appears on every page.
Any idea where does that come from ?
Thanks
Editorial Staff says
That is an unlikely behavior. Without looking at the specific situation, we can’t tell you why it is doing that. We do know that by following this tutorial as it is written, you should be able to make it work. We have it running on WPBeginner.
Yönetici
Ollie says
I just had the same problem with the pop-up appearing on almost every page on my wordpress website.
It turns out that on the pages where it was showing up, a wp-admin resource, in this case something from a plugin, was being pulled in and that seems to have triggered the pop up. I’ve since disabled the plugin and the password pop up no longer shows up on those pages.
So, I’d open the source and search for wp-admin to see what’s causing the pop up to appear.
Editorial Staff says
The most common file that is loaded is admin-ajax.php, and we already covered that. If a plugin is loading another file, then yes you have to account for that.
aditya says
I followed up as you said.
I protected my wp-admin directory and It’s working for login but the same popup is always coming out while navigating through site ????
Editorial Staff says
This means that you have the code in the wrong .htaccess file. You need to create a brand new .htaccess file in your /wp-admin/ folder. It sounds like that you pasted the code in your main .htaccess file.
Yönetici
20Music says
Hi,
I followed the suggestion found on your site. I created password from cpanel on the wp-admin folder and it done ok for admin login page but on every link that I click in the website, a popup will appear asking for identification. Everything is alright when I clicked cancel.
Do you know what is the issue with it?
I used the ErrorDocument 401 default on main .htaccees too.
Thanks
Editorial Staff says
Can you please verify that the password protect thing is in a separate .htaccess file in your wp-admin folder?
Yönetici
Brad LeBlanc says
I tried it and I got no window just a 404 error( too many http directs).
And I was blocked out of everything until I disabled the password. What gives?
Editorial Staff says
Did you do the .htaccess trick we mentioned in the article which fixes the 404 error.
Andrew says
Thanks for the excellent help on wpbeginner!
Ariel says
I edited my .htaccess root file (to put the errordocument rule), and the pop-up worked well, but all my post links gives me a 404 error. I think that is a rewrite rule problem
Thanks
Editorial Staff says
Go to your Settings > Permalinks. Just click save and hopefully that will solve the issue.
Yönetici
vic says
the permalink refresh worked! thanks, you saved me from many headaches..!
Tomy says
Really helpful info thanks, I just had a breach apparently, 3 files we added to my WordPress install. 1into wp-admin, 1 to wp-admin/images and 1 to wp-includes.
All were php files. One of them had base 64 encoded crap in it.
Will setup the htaccess in wp-admin, and limit login attempts plugin seems to provide done nice info.
Oh I was able to notice the files that were added to my install because WordPress file monitor plugin alerted me.
Mao Shan says
Hi,
I followed the suggestion found on the internet on how to secure wp-admin folder. I created a .htacess to password protect the folder. However after implementing it, on every link that I click in the website, a popup will appear asking for identification. Everything is alright when I clicked cancel. Do you know what is the issue with it? I want to secure my wp-admin folder but I don’t want the popup on all pages/links. Currently using Mayashop theme and woocommerce plugin only.
Thanks
Below is my sample of .htacess
Order allow,deny
Allow from all
Satisfy any
Order allow,deny
Allow from all
Satisfy any
Order allow,deny
Allow from all
Satisfy any
AuthType Basic
AuthName “Admin Only”
AuthUserFile “(myurl)/.htpasswds/public_html/wp-admin/passwd”
require valid-user
Editorial Staff says
If your .htaccess file is in your /wp-admin/ then this shouldn’t happen. Unless you are loading WordPress admin assets on your front-end.
Yönetici
Mao Shan says
Well the .htaccess file is in wp-admin folder. I changed the theme back to twentyeleven and everything works fine. Only on the other theme, the authorisation required pops out on all pages/links.
I added below line and everything seems alright but when I got to url/wp-admin, it shows Error 310 (net::ERR_TOO_MANY_REDIRECTS): There were too many redirects. What is the reason?
Files ~ “\.(php)$”
Order allow,deny
Allow from all
Satisfy any
Files
Editorial Staff says
Did you read the part of the article that talks about that error specifically?
Mao Shan says
Hi, I manage to solve it after a clean wordpress install. problem is I am now unable to create contact form as it will direct me to error 404 and when i activate xcloner plugin, it also redirect me to error 404.
Any help?
Sudeep Acharya says
I have password protected wp-admin. But inspite of this someone is able to bruteforce on my blog. What may be the possible reason for this?
Editorial Staff says
How do you know that they brute-forced and logged-in to your wp-admin? This sounds really suspicious. Often when this happens, the user has a backdoor in place.
Yönetici
Sudeep Acharya says
I had got too many redirects loop and just adding this code
ErrorDocument 401 default
in .httaccess fixed the problem.
Ahsan says
Tell me where to put this line… please
ahmedsheeraz says
ErrorDocument 401 default saved my life
John RIker says
I use Cpanel and went through how it was to be set up and did that, also the user and passwor.
However, what I found out after hours of frustration is that the main .htaccess must have this added: ErrorDocument 401 default
If you add that only to the main .htaccess file it all works. at top before the begin wordpress your world will be much more relaxed. Thats after you set protect directory in cpanel
Thanks, used you page with a little twiking and its works great.
damian says
I’m getting so discouraged. My site hacked after only 2 days of being up! The amount of steps needed to take to protect the site is overwhelming, and then they still can get in…
And every “authority” seems to have a different opinion or approach or favorite plugins… my head is spinning…can you please give a basic numbered run down of steps to take to keep from getting hacked…including cpanel, backend wp, and any other things you might think helpful…and hopefully steps that don’t require an A+ cert….thanks man!
Editorial Staff says
We really apologize for the experience you have had so far. Speaking from this moment, there are no known security issues in the WordPress core. So if you are using the most up to date version of WordPress, then that is good. Often the security issues are with poorly coded plugin and themes. Before you can secure your site, you have to clean it up. Sometimes, changing your passwords and adding all these measures are not enough. Because the hackers can leave backdoor access files which gives them shell access to your server. We highly recommend that you start using Sucuri and have regular backups.
https://www.wpbeginner.com/opinion/reasons-why-we-use-sucuri-to-improve-wordpress-security/
Make sure to keep your plugins and core files updated at all times. Don’t use plugin/themes from untrusted sources. WordPress has become the Windows of our time. Because there are so many sites using it, hackers have the motivation to find the exploits in plugins, themes etc.
We will work on creating a comprehensive tutorial on security.
Yönetici
bob says
I password protected my wp-admin on my sites but I was still getting lockout notices from lilmit login plugin. How could that be?
I then noticed if I type in /wp-login.php? instead and then cancel I can get to the login page. Uggggh. Makes me wonder what other workarounds there are that I don’t know of.
Editorial Staff says
You should consider adding this trick as well.
https://www.wpbeginner.com/wp-tutorials/how-to-limit-access-by-ip-to-your-wp-login-php-file-in-wordpress/
Yönetici
Peter says
THE SOLUTION FROM HOSTGATOR
It appears that a security plugin had added a rewrite to the .htaccess file within wp-admin/ for your account. This was causing the site to redirect to itself causing a redirect loop.
I have corrected the issue with .htaccess file and your wp-admin login page is loading correctly at this time.
If you have any other questions or concerns please let us know.
Sincerely,
Preston M.
Linux Systems Administrator
HostGator.com LLC
Peter says
Had a host gator technician working half an hour on the 404 error issue. He could not resolve it.
He even removed all rewrite rules in the public_html/.htaccess
Peter says
Still having “Too many redirects” error
The page isn’t redirecting properly
Firefox has detected that the server is redirecting the request for this address in a way that will never complete.
This problem can sometimes be caused by disabling or refusing to accept
cookies.
BUT I added:
“Redirect 301 /tag/tax/ http://snbchf.com/tag/taxes/
Redirect 301 /tag/interest-rate/ http://snbchf.com/tag/academical/
Redirect 301 /tag/chf-flows-floor-ubs/ http://snbchf.com
Redirect 301 /tag/boom/ http://snbchf.com
RewriteEngine on
ErrorDocument 401 default”
to my .htaccess in the public_html directory.
(tried also to put “ErrorDocument 401 default” at the start)
Ankur says
Its a great way to protect wp-admin directory. I was using it for long time but when I installed commentluv, I had to uninstall it as it was not able to work properly.
Do you happen to know any workaround ?
Editorial Staff says
Just updated the article. Try that
Yönetici
Ankur says
Thanks, commentluv now works fine
mindctrl says
FYI, I’ve seen this break plugins that use ajax on the front end by calling the wp-admin/admin-ajax.php.
Editorial Staff says
Yes that is true. We weren’t using any plugin that was making that call. However, you can add an exception for that file in the .htaccess.
Yönetici
Martin says
I am not sure what cpanel does but adding a simple htpasswd will get you the same result.
Editorial Staff says
Well, you can add a htpasswd. But you would also have to create a .htaccess rule in wp-admin directory to specify that you are locking the directory. Then specify the user or usergroup that is allowed etc. This basically helps us simplify the process.
Yönetici
zimbrul says
The above tutorial is in fact adding security with .htpassword and .htaccess via a user friendly interface in cPanel. After you’ve done the above you’ll notice a .httpassword file has been generated outside your server root (for security reasons) and within the file you’ll find the info you’ve enered as per this tutorial.
Howard says
On every WP site I have, on my very first login after setup, I create another admin account with a name for which I use a formula to construct — and a very strong, computer-generated password. I then long out, and then login to the alternate admin account, and reduce the standard admin username to “no role for this site” and set a computer-generated password that is at least 35 characters long. I don’t bother to save that password anywhere. It’s now only a honeypot.
Then I install the “limit login attempts” plugin. Any time that gets tripped, I add the offending IP address to my deny list in .htaccess to make sure that IP can’t reach my site.
I trap 3 or 4 attempts to break into admin every week.
Editorial Staff says
Yes we had that too. There comes a point when attacks are bouncing IPs. Banning a huge range of IPs is not a sufficient option. We also had login restricted by IP as well, but that didn’t seem to be doing the job either.
Yönetici
Howard says
The “limit login attempts” plugin is pretty good. I have it set to shut off for 100 hours after 4 failed attempts, with the 4th lockout set for 4000 hours. So, even if the perp can dynamically switch IPs, he has to do so every four tries. And with a really long random password, that should take a couple of centuries, and more IP addresses than he is likely to be able to access.
In the highly unlikely case they crack my “admin” it won’t do them any good anyway. Any time I notice that the scumbag has actually figured out what my real admin name is (only happened once so far), I immediately create a new one, and set the old one to “no role for this site” with a really long randomly-generated password. There are a few other details (e.g., first, I have to change the email address before it will let me create the new admin account with my email), but that pretty much did the trick on that one.
I really don’t know if this is bulletproof, but I’m hoping the scumbags decide it’s too much work and go pick on a weaker site.
zimbrul says
” Any time I notice that the scumbag has actually figured out what my real admin name is…” can I ask you how did you figure that?
Howard says
@zimbrul Sure.
The limit login attempts plugin tells me which user name is under attack. Usually, it’s “admin” but there was one occasion where I saw my real admin account’s name. So I created a new admin account, and left the old one there, but gutted of any access, and with a ridiculously long password.
I’m not sure how the perp found the admin account since I assigned it an unrelated “nickname” that appears on postings. I’m guessing there is some file on the server that can be at least partially read by a hacker, and I probably need to research that.
Editorial Staff says
Its fairly easy to find the login name. All the person has to do is look at your author URL to know your username. For example this:
https://www.wpbeginner.com/author/wpbeginner/
The username would be “wpbeginner”. For most sites that is the case unless ofcourse they have changed the username like shown in this technique:
https://www.wpbeginner.com/wp-tutorials/how-to-change-your-wordpress-username/
If you do it like that, then your username will change, but your author URL would not.
zimbrul says
Howard, that’s an interesting point; I’ll try to implement that.
Also I had problems with 404 errors or too many redirects and I didn’t know the fix, thanks for that!
For some reason, banning the IP address in .htaccess in wp-admin folder is not working for my site zimbrul.co.uk ! I’ve tried to access my site from my mobile phone on 3G and I could get through even the only allowed IP was the home IP.
Editorial Staff says
Yeah, this is why it helps to have double authentication like this.
Yönetici