---
title: "Secure access to WordPress admin using .htaccess"
slug: "secure-access-to-wordpress-admin-using-htaccess-1"
updated: 2026-04-13T03:46:31Z
published: 2026-04-13T03:46:31Z
canonical: "docs.serversaustralia.com.au/secure-access-to-wordpress-admin-using-htaccess-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serversaustralia.com.au/llms.txt
> Use this file to discover all available pages before exploring further.

# Secure access to WordPress admin using .htaccess

Access to your WordPress administrator section can be restricted by IP address by adding rules for the website's **.htaccess** file. The file is located in the public_html folder.

The file may assist in mitigating brute force attacks targeting the administrator credentials.

## Accessing the .htaccess file

You can access the .htaccess file by using either of the following methods:

1. Use the 'File Manager' in cPanel to navigate to the file and select “Edit”.
2. SSH - If you have SSH access, then you can edit the file using a text editor, such as vim or nano.

## Restricting access to a single IP address

Add the following rule to your **.htaccess** file, replacing " 999\.999\.999\.999 " with your own IP address, including the backslashes before the full stops e.g. 221\.121\.55\.145:

```plaintext
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^999\.999\.999\.999$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>
```

## Restricting access to multiple IP addresses

Add the following rule to your .htaccess file, replacing "999\.999\.999\.999" with your own IP addresses, including the backslashes before the full stops, e.g., 221\.121\.55\.145.

```plaintext
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^999\.999\.999\.999$
RewriteCond %{REMOTE_ADDR} !^999\.999\.999\.999$
RewriteCond %{REMOTE_ADDR} !^999\.999\.999\.999$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>
```