Directory Privacy with wp-login.php ‘Powered by WordPress’

Viewing 5 replies - 1 through 5 (of 5 total)
  • Moderator threadi

    (@threadi)

    3 years, 2 months ago

    If you configure this access protection manually, it depends on how you place the configuration in the .htaccess and your web server. This can also be a reason for the difference between https and http, because then different vhost settings could take effect.

    I would recommend to use a plugin for this, e.g. this one: https://ww.wp.xz.cn/plugins/http-auth/ – this saves you the trouble of configuring the server.

    Thread Starter oriver

    (@oriver)

    3 years, 2 months ago

    @threadi

    Thanks for your response. The difference isn’t between https or http, as we only allow https, it’s just the addition of www. after https, and the use of cancel to bypass directory privacy on wp-login

    Not looking to use a plugin, for a few different reasons, and would like to use a direct code.

    Just wondering about the above code ‘ErrorDocument 401…’ in conjunction with directory privacy and whether it would still allow the ajax code to work?

    Moderator threadi

    (@threadi)

    3 years, 2 months ago

    The answer to the question depends on the Apache version used. As of version 2.4, some settings have changed in this regard. Your question therefore has little to do with WordPress as Apache is a separate application that is called before WordPress on every request.

    Also www and without www make a difference in the vhost settings. Are these 2 different vhosts or the same one? Check the Apache settings regarding this. WordPress can’t help you here, as I said.

    Thread Starter oriver

    (@oriver)

    3 years, 2 months ago

    @threadi

    Thank you, I will look into this further.

    As it was triggering a ‘powered by wordpress’ login, I had wrongly thought WordPress, but I understand now, thanks to your explanation, that I need to possibly look at Apache and the host provider.

    Thread Starter oriver

    (@oriver)

    3 years, 2 months ago

    This seems to have worked. But can cause directory privacy to ask the password protected wp-login.php and wp-admin twice in a row.

    For the section home/username/.wpadmin – this must match the location where .htpasswd is saved.

    ErrorDocument 401 "Forbidden Access"
<Files "wp-login.php">
AuthUserFile /home/username/.wpadmin
AuthName "Private Access"
AuthType Basic
Require valid-user
</Files>

    And yes it appears the above AJAX code does allow ajax to still work even with directory password.

    • This reply was modified 3 years, 2 months ago by oriver.
Viewing 5 replies - 1 through 5 (of 5 total)

The topic ‘Directory Privacy with wp-login.php ‘Powered by WordPress’’ is closed to new replies.