Password protecting the wp-admin directory
Several places recommend to block the WordPress admin area with a password. While this certainly is a good idea, implementing it properly is non-trivial.
One of the problems is that the WordPress Ajax handler script is located in the admin directory. So password-protecting the admin area will break all Ajax functionality your blog might be using on the frontend.
First, see this tutorial on how to password protect directories with an .htaccess file. Sivel has an example for whitelisting the Ajax handler, add these line to your .htaccess file:
# These are the lines that do the password protection.
# You probably already created them while reading through the tutorial linked above.
AuthUserFile /path/to/your/htpasswd
AuthType basic
AuthName "Restricted Resource"
require valid-user# This is the whitelisting of the ajax handler
<Files admin-ajax.php>
Order allow,deny
Allow from all
Satisfy any
</Files>
Please notice that you absolutely need to create the htpasswd file, see the linked tutorial above.
Update: /wp-admin/css/install.css is also sometimes needed on the frontend, you should whitelist that as well.Here's the necessary configuration to whitelist a file in a password protected location in lighttpd:
$HTTP["url"] =~ "^\/wp-admin\/.*" {
$HTTP["url"] !~ "^\/wp-admin\/(admin-ajax\.php|css\/.*)" {
auth.require = (
"" => (
"method" => "basic",
"realm" => "Password protected area",
"require" => "user=theuser",
),
),
},
},
I am Nicolas Kuttler, a web developer, system administrator and IT consultant from France, currently living in Germany.
Just to note: I'm not on HostGator, and I didn't even bother to create the myerror.html page, and it still worked. Now I can log into the /wp-admin directory again with the added layer of security provided by htaccess password-protection. :)
I haven't played around with them or the undocumented(?) WP_CACHE but thought I should at least put the flag up in case anyone had any strange problems...
Aaaah, the usual wp mess :-)