How do I protect wp-admin or sensitive folders? Print

Adding an extra login in front of wp-admin stops most automated WordPress attacks. The cleanest way is cPanel's Directory Privacy:

1. Open Directory Privacy, browse into your site's wp-admin folder, and enable password protection.
2. Create a username and password — now visitors need this before they even reach the WordPress login.

If protecting all of wp-admin breaks AJAX, instead protect only wp-login.php using .htaccess rules, or limit access by IP. Other good steps:

• Use a strong admin password and enable a security plugin with login limits.
• Set wp-config.php permissions to 600 and folders to 755.
• Keep WordPress and plugins updated.

For help configuring rules without breaking your site, open a ticket.