{"id":1013,"date":"2024-08-04T21:02:22","date_gmt":"2024-08-04T14:02:22","guid":{"rendered":"https:\/\/doaction.co.th\/?p=1013"},"modified":"2024-12-11T12:37:44","modified_gmt":"2024-12-11T05:37:44","slug":"hide-wp-login-htpasswd","status":"publish","type":"post","link":"https:\/\/doaction.co.th\/en\/hide-wp-login-htpasswd\/","title":{"rendered":"Enhance Security: Add a Layer by Hiding wp-login for WordPress"},"content":{"rendered":"

Not hiding the wp-login.php page on a WordPress site when it goes into production is an important security issue. While it is just one of many security measures that should be implemented, hiding the wp-login.php page can help reduce the risk of brute force attacks, which involve trying to guess passwords to gain access. This not only increases the risk of being hacked but can also cause the server to work harder due to continuous password-guessing attacks.<\/p>\n\n\n\n

If you choose to keep the wp-login.php page accessible, you should set limits on the number of login attempts. If the limit is exceeded, you can configure the system to ban the IP address. This approach is better than having it open without any restrictions, as bots often automatically search for wp-login.php and try to log in. Changing the login URL can make it harder for bots to find the login page, thus enhancing the security of the website.<\/p>\n\n\n\n

Recommendations for Preventing Brute Force Attacks from WordPress<\/h2>\n\n\n\n

According to the official recommendations from WordPress on preventing brute force attacks, the following measures are advised:<\/p>\n\n\n\n

    \n
  1. Change the Login URL:<\/strong> Modify the URL from wp-login.php to avoid direct attacks.<\/li>\n\n\n\n
  2. Use Strong Passwords<\/strong> Create complex passwords that are hard to guess and change them frequently.<\/li>\n\n\n\n
  3. Limit Login Attempts:<\/strong> Use plugins that limit the number of failed login attempts.<\/li>\n\n\n\n
  4. Enable Two-Factor Authentication (2FA):<\/strong> Enhance security by implementing two-factor authentication.<\/li>\n\n\n\n
  5. Block Suspicious IPs<\/strong> Block IPs exhibiting suspicious behavior to prevent attacks.<\/li>\n<\/ol>\n\n\n\n
    \"Prompt
    Prompt Login \u0e08\u0e32\u0e01\u0e01\u0e32\u0e23\u0e40\u0e1b\u0e34\u0e14\u0e43\u0e0a\u0e49 .htpasswd<\/figcaption><\/figure>\n\n\n\n

    How to Create a .htpasswd File to Prevent Direct Access to wp-login.php<\/h2>\n\n\n\n

    How to hide access to wp-login.php without installing additional plugins, as recommended by WordPress Best Practices. You only need to write a few lines of code. We will create an additional layer to protect access to the login page by using features from AppServe and NGINX.<\/p>\n\n\n\n

    Every time you access the wp-login.php page, a login prompt will appear, asking you to enter a username and password. If you enter the wrong credentials, you will not be able to access the WordPress login page. To set this up, you need to create a .htpasswd file and modify the .htaccess file together.<\/p>\n\n\n\n

    The first step is to create a .htpasswd file, which you can learn about by clicking Check this out<\/a> .<\/p>\n\n\n\n

    \"\u0e15\u0e31\u0e27\u0e2a\u0e23\u0e49\u0e32\u0e07
    \u0e15\u0e31\u0e27\u0e2a\u0e23\u0e49\u0e32\u0e07 .htpasswd<\/figcaption><\/figure>\n\n\n\n

    Enter the username and password for authentication used in the Prompt Login. Then, select Bcrypt (Apache v2.4 onwards) and click the Create .htpasswd file button. You will receive a text string that looks like the following:<\/p>\n\n\n\n

    demo:$2y$10$mHPbKdzE4up1TsWmaKurCeJQmPMeMeIiMHc7hQL5jJ64PbA1mAOIu<\/pre>\n\n\n\n
    \"directory
    directory \u0e17\u0e35\u0e48\u0e19\u0e33\u0e44\u0e1b\u0e27\u0e32\u0e07 .htpasswd<\/figcaption><\/figure>\n\n\n\n
    \"\"
    \u0e27\u0e32\u0e07 generate text \u0e17\u0e35\u0e48\u0e44\u0e1f\u0e25\u0e4c<\/figcaption><\/figure>\n\n\n\n
    Create a .htpasswd file in the root directory of your host. This is the same location as the .htaccess file that WordPress initially creates. Then, insert the text string generated earlier into the .htpasswd file and proceed to the next step.<\/p>\n\n\n\n
    Modify the .htaccess File to Set Conditions for Prompt Login Before Accessing wp-login.php<\/h2>\n\n\n\n
    If your server uses Apache, place the following code at the top of the .htaccess file. The  tag specifies that anyone accessing this URL must log in first.<\/p>\n\n\n\n
    # \u0e40\u0e23\u0e34\u0e48\u0e21\u0e01\u0e32\u0e23\u0e15\u0e31\u0e49\u0e07\u0e04\u0e48\u0e32\u0e01\u0e32\u0e23\u0e1b\u0e49\u0e2d\u0e07\u0e01\u0e31\u0e19\u0e44\u0e1f\u0e25\u0e4c wp-login.php\n<Files wp-login.php>\n    # \u0e23\u0e30\u0e1a\u0e38\u0e44\u0e1f\u0e25\u0e4c\u0e17\u0e35\u0e48\u0e40\u0e01\u0e47\u0e1a\u0e02\u0e49\u0e2d\u0e21\u0e39\u0e25\u0e1c\u0e39\u0e49\u0e43\u0e0a\u0e49\u0e41\u0e25\u0e30\u0e23\u0e2b\u0e31\u0e2a\u0e1c\u0e48\u0e32\u0e19\n    AuthUserFile ~\/.htpasswd\n    \n    # \u0e23\u0e30\u0e1a\u0e38\u0e0a\u0e37\u0e48\u0e2d\u0e17\u0e35\u0e48\u0e08\u0e30\u0e41\u0e2a\u0e14\u0e07\u0e40\u0e21\u0e37\u0e48\u0e2d\u0e02\u0e2d\u0e43\u0e2b\u0e49\u0e1c\u0e39\u0e49\u0e43\u0e0a\u0e49\u0e43\u0e2a\u0e48\u0e02\u0e49\u0e2d\u0e21\u0e39\u0e25\u0e01\u0e32\u0e23\u0e40\u0e02\u0e49\u0e32\u0e2a\u0e39\u0e48\u0e23\u0e30\u0e1a\u0e1a\n    AuthName \"Private access\"\n    \n    # \u0e01\u0e33\u0e2b\u0e19\u0e14\u0e1b\u0e23\u0e30\u0e40\u0e20\u0e17\u0e01\u0e32\u0e23\u0e22\u0e37\u0e19\u0e22\u0e31\u0e19\u0e15\u0e31\u0e27\u0e15\u0e19\u0e40\u0e1b\u0e47\u0e19 Basic\n    AuthType Basic\n    \n    # \u0e23\u0e30\u0e1a\u0e38\u0e0a\u0e37\u0e48\u0e2d\u0e1c\u0e39\u0e49\u0e43\u0e0a\u0e49\u0e17\u0e35\u0e48\u0e44\u0e14\u0e49\u0e23\u0e31\u0e1a\u0e2d\u0e19\u0e38\u0e0d\u0e32\u0e15\u0e43\u0e2b\u0e49\u0e40\u0e02\u0e49\u0e32\u0e16\u0e36\u0e07\u0e44\u0e1f\u0e25\u0e4c wp-login.php\n    # demo = user \u0e17\u0e35\u0e48\u0e40\u0e23\u0e32\u0e2a\u0e23\u0e49\u0e32\u0e07\u0e02\u0e36\u0e49\u0e19\u0e21\u0e32\n    require user demo\n<\/Files><\/pre>\n\n\n\n
    .htaccess<\/p>\n\n\n\n
    For NGINX, place the code below in nginx.conf instead, which will function the same way.<\/p>\n\n\n\n
    location \/wp-login.php {\n    auth_basic \"Private access\";         # \u0e02\u0e49\u0e2d\u0e04\u0e27\u0e32\u0e21\u0e17\u0e35\u0e48\u0e08\u0e30\u0e41\u0e2a\u0e14\u0e07\u0e43\u0e19\u0e01\u0e25\u0e48\u0e2d\u0e07\u0e01\u0e32\u0e23\u0e22\u0e37\u0e19\u0e22\u0e31\u0e19\u0e15\u0e31\u0e27\u0e15\u0e19\n    auth_basic_user_file .htpasswd;      # \u0e44\u0e1f\u0e25\u0e4c\u0e17\u0e35\u0e48\u0e40\u0e01\u0e47\u0e1a\u0e02\u0e49\u0e2d\u0e21\u0e39\u0e25\u0e0a\u0e37\u0e48\u0e2d\u0e1c\u0e39\u0e49\u0e43\u0e0a\u0e49\u0e41\u0e25\u0e30\u0e23\u0e2b\u0e31\u0e2a\u0e1c\u0e48\u0e32\u0e19\n}<\/pre>\n\n\n\n
    nginx.conf<\/p>\n\n\n\n
    A common issue is that .htaccess does not find the .htpasswd file. This depends on the server configuration. In some cases, using . (a dot for the current directory where .htaccess is located) will suffice, while in others, you may need to provide the absolute path to the file. If you\u2019re unsure of the absolute path, you can contact your server provider for assistance.<\/p>\n\n\n\n
    Conclusion<\/h2>\n\n\n\n
    After placing the .htpasswd file and modifying the .htaccess file, when attempting to access the backend by typing \/wp-login.php directly or navigating to \/wp-admin, the system will redirect to wp-login.php, where a login prompt will appear. If the username and password are entered incorrectly, access to the WordPress login page will be denied. This acts as an additional layer of protection.<\/p>\n\n\n\n
    \"\"<\/figure>\n\n\n\n
    The login prompt doesn\u2019t protect against brute force attacks 100%. Some providers install Fail2Ban to enhance the system\u2019s security. Fail2Ban monitors and blocks IPs that repeatedly attempt to attack or fail to log in, reducing the likelihood of successful brute force attacks.<\/p>\n\n\n\n
    Preventing brute force attacks is just one method to secure WordPress, but there are many other ways. If you\u2019re interested, you can read more details here<\/a><\/p>","protected":false},"excerpt":{"rendered":"
    \u0e01\u0e32\u0e23\u0e44\u0e21\u0e48\u0e0b\u0e48\u0e2d\u0e19\u0e2b\u0e19\u0e49\u0e32 wp-login.php \u0e43\u0e19\u0e40\u0e27\u0e47\u0e1a\u0e44\u0e0b\u0e15\u0e4c WordPress \u0e1a\u0e19 Production \u0e40\u0e1b\u0e47\u0e19\u0e1b\u0e23\u0e30\u0e40\u0e14\u0e47\u0e19\u0e17\u0e35\u0e48\u0e2a\u0e33\u0e04\u0e31\u0e0d\u0e43\u0e19\u0e14\u0e49\u0e32\u0e19\u0e04\u0e27\u0e32\u0e21\u0e1b\u0e25\u0e2d\u0e14\u0e20\u0e31\u0e22 \u0e41\u0e21\u0e49\u0e27\u0e48\u0e32\u0e08\u0e30\u0e40\u0e1b\u0e47\u0e19\u0e40\u0e1e\u0e35\u0e22\u0e07\u0e2b\u0e19\u0e36\u0e48\u0e07\u0e43\u0e19\u0e2b\u0e25\u0e32\u0e22 \u0e46 \u0e21\u0e32\u0e15\u0e23\u0e01\u0e32\u0e23\u0e17\u0e35\u0e48\u0e04\u0e27\u0e23\u0e19\u0e33\u0e21\u0e32\u0e1b\u0e0f\u0e34\u0e1a\u0e31\u0e15\u0e34 \u0e01\u0e32\u0e23\u0e0b\u0e48\u0e2d\u0e19\u0e2b\u0e19\u0e49\u0e32 wp-login.php \u0e2a\u0e32\u0e21\u0e32\u0e23\u0e16\u0e0a\u0e48\u0e27\u0e22\u0e25\u0e14\u0e04\u0e27\u0e32\u0e21\u0e40\u0e2a\u0e35\u0e48\u0e22\u0e07\u0e08\u0e32\u0e01\u0e01\u0e32\u0e23\u0e42\u0e08\u0e21\u0e15\u0e35\u0e41\u0e1a\u0e1a Brute Force \u0e0b\u0e36\u0e48\u0e07\u0e40\u0e1b\u0e47\u0e19\u0e01\u0e32\u0e23\u0e1e\u0e22\u0e32\u0e22\u0e32\u0e21\u0e2a\u0e38\u0e48\u0e21\u0e23\u0e2b\u0e31\u0e2a\u0e1c\u0e48\u0e32\u0e19\u0e40\u0e1e\u0e37\u0e48\u0e2d\u0e40\u0e02\u0e49\u0e32\u0e2a\u0e39\u0e48\u0e23\u0e30\u0e1a\u0e1a \u0e19\u0e2d\u0e01\u0e08\u0e32\u0e01\u0e08\u0e30\u0e40\u0e1e\u0e34\u0e48\u0e21\u0e04\u0e27\u0e32\u0e21\u0e40\u0e2a\u0e35\u0e48\u0e22\u0e07\u0e15\u0e48\u0e2d\u0e01\u0e32\u0e23\u0e16\u0e39\u0e01\u0e41\u0e2e\u0e01\u0e41\u0e25\u0e49\u0e27 \u0e22\u0e31\u0e07\u0e2d\u0e32\u0e08\u0e17\u0e33\u0e43\u0e2b\u0e49\u0e40\u0e0b\u0e34\u0e23\u0e4c\u0e1f\u0e40\u0e27\u0e2d\u0e23\u0e4c\u0e17\u0e33\u0e07\u0e32\u0e19\u0e2b\u0e19\u0e31\u0e01\u0e02\u0e36\u0e49\u0e19\u0e08\u0e32\u0e01\u0e01\u0e32\u0e23\u0e42\u0e08\u0e21\u0e15\u0e35\u0e14\u0e49\u0e27\u0e22\u0e01\u0e32\u0e23\u0e2a\u0e38\u0e48\u0e21\u0e23\u0e2b\u0e31\u0e2a\u0e1c\u0e48\u0e32\u0e19\u0e2d\u0e22\u0e48\u0e32\u0e07\u0e15\u0e48\u0e2d\u0e40\u0e19\u0e37\u0e48\u0e2d\u0e07 \u0e2b\u0e32\u0e01\u0e15\u0e49\u0e2d\u0e07\u0e01\u0e32\u0e23\u0e40\u0e1b\u0e34\u0e14\u0e2b\u0e19\u0e49\u0e32 wp-login.php \u0e40\u0e2d\u0e32\u0e44\u0e27\u0e49\u0e01\u0e47\u0e2a\u0e32\u0e21\u0e32\u0e23\u0e16\u0e17\u0e33\u0e44\u0e14\u0e49 \u0e41\u0e15\u0e48\u0e04\u0e27\u0e23\u0e21\u0e35\u0e01\u0e32\u0e23\u0e15\u0e31\u0e49\u0e07\u0e04\u0e48\u0e32\u0e08\u0e33\u0e01\u0e31\u0e14\u0e08\u0e33\u0e19\u0e27\u0e19\u0e04\u0e23\u0e31\u0e49\u0e07\u0e43\u0e19\u0e01\u0e32\u0e23\u0e1e\u0e22\u0e32\u0e22\u0e32\u0e21\u0e40\u0e02\u0e49\u0e32\u0e2a\u0e39\u0e48\u0e23\u0e30\u0e1a\u0e1a \u0e41\u0e25\u0e30\u0e2b\u0e32\u0e01\u0e40\u0e01\u0e34\u0e19\u0e08\u0e33\u0e19\u0e27\u0e19\u0e17\u0e35\u0e48\u0e01\u0e33\u0e2b\u0e19\u0e14\u0e01\u0e47\u0e2a\u0e32\u0e21\u0e32\u0e23\u0e16\u0e15\u0e31\u0e49\u0e07\u0e04\u0e48\u0e32\u0e43\u0e2b\u0e49\u0e41\u0e1a\u0e19 IP \u0e44\u0e14\u0e49 \u0e27\u0e34\u0e18\u0e35\u0e19\u0e35\u0e49\u0e14\u0e35\u0e01\u0e27\u0e48\u0e32\u0e01\u0e32\u0e23\u0e40\u0e1b\u0e34\u0e14\u0e44\u0e27\u0e49\u0e42\u0e14\u0e22\u0e44\u0e21\u0e48\u0e21\u0e35\u0e01\u0e32\u0e23\u0e08\u0e33\u0e01\u0e31\u0e14\u0e2d\u0e30\u0e44\u0e23\u0e40\u0e25\u0e22 \u0e40\u0e19\u0e37\u0e48\u0e2d\u0e07\u0e08\u0e32\u0e01 bot \u0e21\u0e31\u0e01\u0e08\u0e30\u0e27\u0e34\u0e48\u0e07\u0e2b\u0e32 wp-login.php \u0e42\u0e14\u0e22\u0e2d\u0e31\u0e15\u0e42\u0e19\u0e21\u0e31\u0e15\u0e34\u0e41\u0e25\u0e30\u0e1e\u0e22\u0e32\u0e22\u0e32\u0e21\u0e40\u0e02\u0e49\u0e32\u0e2a\u0e39\u0e48\u0e23\u0e30\u0e1a\u0e1a \u0e2b\u0e32\u0e01\u0e40\u0e23\u0e32\u0e40\u0e1b\u0e25\u0e35\u0e48\u0e22\u0e19 URL \u0e02\u0e2d\u0e07\u0e2b\u0e19\u0e49\u0e32\u0e25\u0e47\u0e2d\u0e01\u0e2d\u0e34\u0e19 \u0e01\u0e47\u0e08\u0e30\u0e0a\u0e48\u0e27\u0e22\u0e16\u0e48\u0e27\u0e07\u0e40\u0e27\u0e25\u0e32\u0e43\u0e2b\u0e49 bot \u0e2b\u0e32\u0e2b\u0e19\u0e49\u0e32\u0e25\u0e47\u0e2d\u0e01\u0e2d\u0e34\u0e19\u0e44\u0e14\u0e49\u0e22\u0e32\u0e01\u0e02\u0e36\u0e49\u0e19 \u0e0b\u0e36\u0e48\u0e07\u0e0a\u0e48\u0e27\u0e22\u0e40\u0e1e\u0e34\u0e48\u0e21\u0e04\u0e27\u0e32\u0e21\u0e1b\u0e25\u0e2d\u0e14\u0e20\u0e31\u0e22\u0e43\u0e2b\u0e49\u0e01\u0e31\u0e1a\u0e40\u0e27\u0e47\u0e1a\u0e44\u0e0b\u0e15\u0e4c\u0e44\u0e14\u0e49\u0e21\u0e32\u0e01\u0e02\u0e36\u0e49\u0e19 \u0e04\u0e33\u0e41\u0e19\u0e30\u0e19\u0e33\u0e40\u0e23\u0e37\u0e48\u0e2d\u0e07\u0e01\u0e32\u0e23\u0e1b\u0e49\u0e2d\u0e07\u0e01\u0e31\u0e19 Brute Force \u0e08\u0e32\u0e01 WordPress \u0e42\u0e14\u0e22\u0e15\u0e32\u0e21\u0e04\u0e33\u0e41\u0e19\u0e30\u0e19\u0e33\u0e40\u0e1b\u0e47\u0e19\u0e17\u0e32\u0e07\u0e01\u0e32\u0e23\u0e02\u0e2d\u0e07 WordPress \u0e40\u0e23\u0e37\u0e48\u0e2d\u0e07\u0e01\u0e32\u0e23\u0e1b\u0e49\u0e2d\u0e07\u0e01\u0e31\u0e19 Brute Force \u0e41\u0e19\u0e30\u0e19\u0e33\u0e43\u0e2b\u0e49\u0e17\u0e31\u0e49\u0e07\u0e2b\u0e21\u0e14\u0e14\u0e31\u0e07\u0e19\u0e35\u0e49 \u0e27\u0e34\u0e18\u0e35\u0e01\u0e32\u0e23\u0e2a\u0e23\u0e49\u0e32\u0e07 .htpasswd \u0e40\u0e1e\u0e37\u0e48\u0e2d\u0e1b\u0e49\u0e2d\u0e07\u0e01\u0e31\u0e19\u0e01\u0e32\u0e23\u0e40\u0e02\u0e49\u0e32\u0e16\u0e36\u0e07 wp-login \u0e42\u0e14\u0e22\u0e15\u0e23\u0e07 \u0e27\u0e34\u0e18\u0e35\u0e01\u0e32\u0e23\u0e0b\u0e48\u0e2d\u0e19\u0e01\u0e32\u0e23\u0e40\u0e02\u0e49\u0e32\u0e16\u0e36\u0e07 […]<\/p>\n","protected":false},"author":1,"featured_media":1116,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_gspb_post_css":"","inline_featured_image":false,"footnotes":""},"categories":[43],"tags":[71,72,70,49],"class_list":["post-1013","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-knowledge","tag-layer","tag-login","tag-security","tag-wordpress"],"acf":{"eng_thumbnail":1116,"eng_title":"Enhance Security: Add a Layer by Hiding wp-login for WordPress","eng_description":"Not hiding the wp-login.php page on a WordPress site when it goes into production is an important security issue. While it is just one of many security measures that should be implemented, hiding the wp-login.php page can help reduce the risk of brute force attacks, which involve trying to guess passwords to gain access. This not only increases the risk of being hacked but can also cause the server to work harder due to continuous password-guessing attacks."},"_links":{"self":[{"href":"https:\/\/doaction.co.th\/en\/wp-json\/wp\/v2\/posts\/1013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/doaction.co.th\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/doaction.co.th\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/doaction.co.th\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/doaction.co.th\/en\/wp-json\/wp\/v2\/comments?post=1013"}],"version-history":[{"count":3,"href":"https:\/\/doaction.co.th\/en\/wp-json\/wp\/v2\/posts\/1013\/revisions"}],"predecessor-version":[{"id":1485,"href":"https:\/\/doaction.co.th\/en\/wp-json\/wp\/v2\/posts\/1013\/revisions\/1485"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/doaction.co.th\/en\/wp-json\/wp\/v2\/media\/1116"}],"wp:attachment":[{"href":"https:\/\/doaction.co.th\/en\/wp-json\/wp\/v2\/media?parent=1013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/doaction.co.th\/en\/wp-json\/wp\/v2\/categories?post=1013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/doaction.co.th\/en\/wp-json\/wp\/v2\/tags?post=1013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}