Learn how to ef­fect­ively protect the ad­min­is­tra­tion area of your WordPress blog from hackers and brute force attacks with .htaccess directory pro­tec­tion.

You can improve the security of your website by ac­tiv­at­ing password pro­tec­tion for the directory /wp-admin and thus for the file wp-login.php using a .htaccess file. Af­ter­wards two different logins are necessary to call the WordPress-Admin.

Managed Hosting for WordPress
Create your site with AI, we manage the rest
  • Stress-free, no matter your skill level with easy AI tools
  • Full cus­tom­isa­tion with themes and plugins
  • Hassle-free updates and less admin

What is a .htaccess file?

A .htaccess file is a con­fig­ur­a­tion file that you can use to make directory-specific settings on a com­pat­ible web server (e.g. the Apache web server used in IONOS hosting). This includes the pos­sib­il­ity of pro­tect­ing dir­ect­or­ies on the web space with a password query.

To create a .htacces file, all you need is a text editor such as Notepad.

Enable directory pro­tec­tion for /wp-admin

When you log on to your dashboard, WordPress loads the required pages - or files - from the /wp-admin sub­dir­ect­ory. This is therefore the ap­pro­pri­ate place to set up directory pro­tec­tion.

If directory pro­tec­tion is activated, an ad­di­tion­al login window opens after clicking the login button, here's what it looks like:

Image: WordPress Directory Protection
WordPress Directory Pro­tec­tion

Below you will learn how to set up this ad­di­tion­al password pro­tec­tion for your WordPress blog.

Create the files .htaccess and .htpasswd

In addition to .htaccess, a file with the name .htpasswd is also required for the con­ver­sion. This contains the user name(s) and password. However, start by creating the .htaccess file first:

If you are already using a .htaccess file for the /wp-admin directory for other reasons, you would overwrite it later in this guide. However, you can simply download your previous .htaccess, add the new lines there, adjust them and then upload the file again.

Create .htaccess:

  • Create a file called .htaccess (the dot is important!) locally on your PC using a text editor.

  • Copy the following lines of code into your .htaccess file:

AuthType Basic
AuthName "Protected Area"
AuthUserFile /homepages/xx/xxxxxxxxx/htdocs/[Ordner]/wp-admin/.htpasswd
require user [Username]

Enter path to WordPress in­stall­a­tion

Now it is necessary to adapt the copied code to your WordPress in­stall­a­tion:

  • The character string /homepages/xx/xxxxxxxxxxx/htdocs/ is an example of the document root, i.e. the absolute path to your Internet presence (i.e. the top directory level). You can find it in your Control Panel.
  • Replace [Folder] with the directory path where your WordPress in­stall­a­tion is located. If you have installed your WordPress blog e.g. in a directory of the same name "wordpress", replace "[folder]" with wordpress. Pay attention to upper and lower case.
  • Replace the text [Username] with any username, for example user, test or similar. You can also specify multiple names separated by spaces to allow multiple people access.
  • You can replace the password-protected area text with any text, for example, Only for Insiders or similar.

The edited .htaccess could look like this:

Image: .htaccess file
.htaccess file

Create .htpasswd

Create a new file on your PC called .htpasswd (don't forget the dot).
Enter the username(s) and password in the following form:

[Username]:[EncryptedPasswort]

You can easily generate the encrypted password yourself online. Enter the search term "generate .htpasswd" into a search engine and tools and websites will be suggested to you with which you can quickly generate the encrypted password yourself.

If you set up multiple users, each user name must begin on a new line.

The following example contains the users user and test:

Image: .htpasswd file
.htpasswd file

upload .htaccess and .htpasswd to webspace

After you have created and adjusted the .htaccess and .htpasswd, you have to upload them to the /wp-admin directory below your WordPress directory on the web space. The password pro­tec­tion is then im­me­di­ately active.

Important: Upload these two files in ASCII (text) mode to the folders on your web space (an ap­pro­pri­ate option should be included in your FTP program, if not, it will auto­mat­ic­ally be done correctly).

Uploading with FileZilla

In the following we will show you how to upload data to your webspace using the example of the FTP program FileZilla.

  • Launch FileZilla.
  • Call up the settings there via Edit > Settings and set the default transfer type ASCII under Transfers > File Types. The file type txt is already preset for the file types.
Image: FileZilla Upload
Uploading with FileZilla
  • Click OK to save.
  • Enter your FTP login details and click on Connect
Image: Connect to server
Uploading with FileZilla: Connect to server
  • Establish an FTP con­nec­tion to the web space:
    • - Server: Auto­mat­ic­ally created IONOS­sub­do­main
    • - Username: Your FTP username
    • - Password: Your FTP password
    • - Port: No spe­cific­a­tion necessary
  • Search and open the directory /wp-admin (A) on the webspace and copy the .haccess and . htpasswd files from your PC to the directory by dragging them with the mouse (B):
Image: File Upload
Select and upload files

The password pro­tec­tion is then im­me­di­ately active. If you want to disable this later, delete the .haccess and htpasswd files from the directory on your web space.

SSL Cer­ti­fic­ate Checker

If the password pro­tec­tion does not work

If the password pro­tec­tion does not work, these are the most common sources of error:

  • Is the file path to the ".htpasswd" file specified in the ".htaccess" file correct?
  • Does the username(s) in the ".htaccess" and ".htpasswd files really match (case sensitive)?
  • Have you also entered the password in the encrypted form (crypt) in the file .htpassd?
  • Did you upload the files to the correct directory (/wp-admin)?
  • Have you also entered the password in the most encrypted form in the .htpassd file?
Go to Main Menu