Not too long ago, we showed you how and why you need to limit login attempts in WordPress. Shortly after pushing that article, we started seeing an influx in attacks on our site. We had 39 lockouts from various IP addresses in a matter of few hours. Not sure whether it was people who just wanted to test this plugin out so they started to do failed attempts on our site, or whether it was real hackers. As a security measure, we decided to limit access by IP to our wp-login.php file in WordPress. We already have our WP Admin directory on limited access by IP. In this article, we will show you how to limit access by IP to your wp-login.php file in WordPress.

Note: This tutorial is not for total beginners.

Open your main .htaccess file and put this code towards the top of the file before everything else. This should be located in the WordPress root folder. Then add this information in there

order deny,allow
Deny from all
 
# whitelist West Palm Beach IP address
allow from xx.xxx.xx.xx
 
#whitelist Gainesvile IP Address
allow from xx.xxx.xx.xx

Don’t forget to replace the IP addresses with your own. The only real downside to this is if you have dynamic IPs, then it can be a problem as your IP will change many times and you won’t be able to access your content. Otherwise, this works like charm. Another issue is that the wp-login.php styling breaks, but that is a small thing that we can endure. In the end, we just wanted to prevent the failed login attempts.