I wonder why test.html is Forbidden (as expected) but wp-login.php is available. I tried both FilesMatch and Files. They have similar "chown" and "chmod". I've read official Apache 2.4 docs. I googled a lot. I can not understand what's wrong in this correct config, and why wp-login.php is always available. How could it be denied for access?!

<Directory /home/user/html>

Require all granted
Options -Indexes

   <FilesMatch "^wp(.*)$">
    <IfModule mod_authz_core.c>
        Require all denied
        Require ip 10.145.13

  <FilesMatch "^test(.*)$">
    <IfModule mod_authz_core.c>
        Require all denied
        Require ip 10.145.13



Thank you Philip, I also thought about something like this - includes and so on...

When you browse to /wp-login Apache is not loading wplogin first.

Not sure, because there's no such a directory /wp-login , there's just a file wp-login.php and I open it directly - http://...my..blog/wp-login.php

By the way, I remembered just now - it worked like a charm when I used Apache 2.2. Now I have 2.4, but the Wordpress remains the same. As we know, 2.4 has different syntax. So, I adopted new config to serve in the same way as my old 2.2 config. But...

That's strange.

And I found an article https://www.saotn.org/wordpress-htaccess-security-best-practices-apache-24/ Though, I configured everything in the same way before. Just to confirm that my settings are correct.

So, I'm not sure what to do.

UPD: found this https://stackoverflow.com/questions/32487034/apache-2-4-restricting-access-to-wp-login-php-by-ip-not-working


This will be to do with wordpress's architecture. When you browse to /wp-login Apache is not loading wplogin first. Instead rewrite rules are used to rewrite the URL.

Off the top of my head I can't remember the entry point but a different PHP file is called from Apache with wp-login as an argument.

That other PHP file then includes wp-login.php. Apache cannot control this.

These rules are often stored in a .htaccess file.

To prove this you can temporarily disable Apache from using .htaccess files an disable all other rewrite rules.

For a permanent solution you could tweak the rewrite rules to reject or ignore wp-login.php with added conditions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.