Title: Admin Access Restriction
Last modified: August 24, 2016

---

# Admin Access Restriction

 *  Resolved [atdblog](https://wordpress.org/support/users/atdblog/)
 * (@atdblog)
 * [11 years, 1 month ago](https://wordpress.org/support/topic/admin-access-restriction/)
 * Hey Paul,
 * 3 things:
 * 1. Just realized that having my IP whitelisted effectively disables the Admin
   Access Restriction. ;-p
 * 2. Love the new tabs.
 * 3. On XML-RPC: You have the By-Pass for XML-RPC Compatibility in both Login Protection
   and User Management. I’ve read in numerous WP Hardening articles that its a good
   idea to disable XML-RPC to prevent some methods of DDoS and Brute Force attacks(
   unless you have one of the few plugins that need it). You talked about “misinformation”
   on security fixes when you find so many who agree – I hope this isn’t one of 
   them! An example article is this one ([http://www.blogaid.net/disable-xml-rpc-in-wordpress-to-prevent-ddos-attack](http://www.blogaid.net/disable-xml-rpc-in-wordpress-to-prevent-ddos-attack))
   where the author recommends turning it “all the way off” in wp-config.php:
 * `add_filter('xmlrpc_enabled', '__return_false');`
 * I haven’t found any issues by doing it in my site. And your plugin page description
   says the option is to “by-pass … rules” so I’m assuming one of your firewall 
   rules is to disable XML-RPC in WPSF (right?). But just so I understand, why is
   the by-pass found in both the Login Protection and User Management Protection
   tabs of your plugin?
 * Thanks!
 * [https://wordpress.org/plugins/wp-simple-firewall/](https://wordpress.org/plugins/wp-simple-firewall/)

Viewing 1 replies (of 1 total)

 *  Plugin Author [Paul](https://wordpress.org/support/users/paultgoodchild/)
 * (@paultgoodchild)
 * [11 years, 1 month ago](https://wordpress.org/support/topic/admin-access-restriction/#post-6077634)
 * Yep, white listing will remove basically the whole firewall processing for you.
   With great power comes great responsibility 🙂
 * Thanks for the feedback on the tabs! I quite like them too… should have done 
   it a long time ago 🙂
 * The XML-RPC thing is really there for people that need/want to use the WordPress
   iPhone/Android app, or use any other service that requires XMLRPC. Unless you
   need it, don’t include the by-pass option.
 * The option is found within 2 sections just by the way it evolved. I would actually
   prefer to centralize it to a global option, but I just haven’t got there yet.
 * Does that help answer the question?

Viewing 1 replies (of 1 total)

The topic ‘Admin Access Restriction’ is closed to new replies.

 * ![](https://ps.w.org/wp-simple-firewall/assets/icon-256x256.png?rev=3054572)
 * [Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning](https://wordpress.org/plugins/wp-simple-firewall/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/wp-simple-firewall/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/wp-simple-firewall/)
 * [Active Topics](https://wordpress.org/support/plugin/wp-simple-firewall/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/wp-simple-firewall/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/wp-simple-firewall/reviews/)

## Tags

 * [xmlrpc](https://wordpress.org/support/topic-tag/xmlrpc/)

 * 1 reply
 * 2 participants
 * Last reply from: [Paul](https://wordpress.org/support/users/paultgoodchild/)
 * Last activity: [11 years, 1 month ago](https://wordpress.org/support/topic/admin-access-restriction/#post-6077634)
 * Status: resolved