WordPress WP-admin IP检查和重定向

Question

I'm planning on using Wordpress on an upcoming project and the biggest question for me is security.

I will be having several users who will be able to update the site and I've given myself several options. I can build a static web page and then have a 'blog' page that is using a WordPress install for that page only. This seems a bit excessive just for a blog feature, but it's an option.

The other option I'm looking at is a full WordPress install to power the whole site. My big issue is blocking the /wp-admin from everyone but the people at a static IP that won't be changing. I'm thinking if I go this route I can use my .htaccess to check the IP and if it returns false, redirect it to the homepage. If it is true, then continue on to the wp-admin login page.

If I go with my second option, how do I use .htaccess to check the IP and if it returns false, redirect back to the homepage. And if it's true, continue to the WordPress login page.

Is this best starting point?

<Location /wp-admin/>
    order allow,deny
    allow from 1.1.1.1
    deny from all 
</Location>

I appreciate any input ahead of time!

Answer 1

You cannot use Location in a .htaccess file. As you can see from the Context it is only allowed in the main server configuration file or in a virtual host section.

Furthermore, you shouldn't use it for security, if wp-admin is a real directory in the file system

<Location> Directive
<Location> sections operate completely outside the filesystem. This has several consequences. Most importantly, <Location> directives should not be used to control access to filesystem locations. Since several different URLs may map to the same filesystem location, such access controls may by circumvented.

If you use Access control by host , the order should be

Order deny,allow
Deny from all
Allow from 1.1.1.1

This ensures, that anybody is prohibited to access /wp-admin/ , except the given IP addresses or domains.

Answer 2

I think this is documented here: http://httpd.apache.org/docs/trunk/howto/auth.html

You may need to couple it with this: http://httpd.apache.org/docs/2.2/howto/htaccess.html , and this: http://httpd.apache.org/docs/trunk/mod/mod_authz_core.html#require

But, it appears that something like this could work:

<Directory /wp-admin/>
    Require ip 192.168.1.104 192.168.1.205
</Directory>

Full disclosure: I'm guessing.

Answer 3

I was able to use what Olaf Dietsche wrote to lead me in the right direction. By putting the below code in my wp-admin folder instead of the root, I was able to control who had access to my url/wp-admin login and if they didn't match the allowed IP, then I redirect them back to the home page.

Options +FollowSymlinks
RewriteEngine on

#urls to exclude
RewriteCond %{REQUEST_URI} !/wp-admin$
RewriteCond %{REQUEST_URI} !^/images$
RewriteCond %{REQUEST_URI} !^/$

#ip to allow access
RewriteCond %{REMOTE_HOST} !^111\.111\.111\.111$

#send to root. If you want a specific URL, use /yourcustomurl.html
RewriteRule .? / [R=302,L]

I appreciate the input everyone. And thank you much!