通过限制.htaccess中的访问权限来保护WordPress中的Admin文件夹

As we mentioned while using WordPress 2.8.3, our site was attacked in an attempt to hack into our WP-Admin folder. Thankfully WordPress has found the bug and released a security patch in WordPress 2.8.4, but this attack made us take extra security measures with our site. We have limited access to our wp-admin folder by using .htaccess and assigning specific IPs that can access it. Before some hacker kept resetting our password and that was because they could see our wp-admin folder and see the login bar. Now no one but WPBeginner Editors can see our admin panel. In this article, we will show you how you can limit wp-admin folder access by IP address using .htaccess file.

正如我们在使用WordPress 2.8.3时提到的那样，我们的网站受到攻击，试图入侵我们的WP-Admin文件夹。 值得庆幸的是，WordPress已经找到了该错误并在WordPress 2.8.4中发布了安全补丁，但是这种攻击使我们对网站采取了额外的安全措施。 通过使用.htaccess并分配可以访问它的特定IP，我们对wp-admin文件夹的访问权限受到限制。 在某些黑客继续重置我们的密码之前，这是因为他们可以看到我们的wp-admin文件夹并看到登录栏。 现在，除了WPBeginner编辑器之外，没有人可以看到我们的管理面板。 在本文中，我们将向您展示如何使用.htaccess文件通过IP地址限制wp-admin文件夹访问。

First you need to open your .htaccess file located in your /wp-admin/ folder, and make a backup.

首先，您需要打开/ wp-admin /文件夹中的.htaccess文件，并进行备份。

Note: Do not edit your Root .htaccess file, don’t paste these codes in there. It must be /wp-admin/.htaccess if you don’t see that file then create a blank file, name it .htaccess in your wp-admin folder.

注意：请勿编辑您的Root .htaccess文件，也不要在其中粘贴这些代码。 如果看不到该文件，则必须为/wp-admin/.htaccess，然后创建一个空白文件，在wp-admin文件夹中将其命名为.htaccess。

Then paste the following code:

然后粘贴以下代码：

AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName "WordPress Admin Access Control"
AuthType Basic
<LIMIT GET>
order deny,allow
deny from all
# whitelist Syed's IP address
allow from xx.xx.xx.xxx
# whitelist David's IP address
allow from xx.xx.xx.xxx
# whitelist Amanda's IP address
allow from xx.xx.xx.xxx
# whitelist Muhammad's IP address
allow from xx.xx.xx.xxx
# whitelist Work IP address
allow from xx.xx.xx.xxx
</LIMIT>

Paste your IP Address and upload the file.

粘贴您的IP地址并上传文件。

Now if you have more than one IP make sure you list them there. For example, Work, Home, Vacation IP, if you ever use it. Each time you want to visit your wp-admin panel from another location, you would have to add an extra IP address. That is the only downside to this hack, but this will keep your wp-admin folder safe.

现在，如果您拥有多个IP，请确保在此处列出它们。 例如，如果您曾经使用过，例如“工作，住家，度假IP”。 每次您想从另一个位置访问wp-admin面板时，都必须添加一个额外的IP地址。 这是该黑客攻击的唯一弊端，但这将确保您的wp-admin文件夹安全。

翻译自: https://www.wpbeginner.com/wp-tutorials/protect-your-admin-folder-in-wordpress-by-limiting-access-in-htaccess/