How to Restrict WordPress Login by IP Address

WordPress login page IP restriction: In today’s digital world, protecting your WordPress site goes beyond just using strong passwords and adding a security plugin. Limiting login access to certain IP addresses is one of the best ways to keep your site safe from brute-force attacks and those who shouldn’t be able to get in. IP-based limitation makes sure that only people from approved places can get to the WordPress login page. This adds an important layer of protection to your site.

In this detailed article, we’ll talk about why you might want to limit access to the WordPress login page, give you step-by-step directions on how to accomplish it using multiple ways, list the advantages and downsides, give you best practices, and suggest other tools to make your site more secure.

Hackers often try to break into WordPress sites, especially with brute-force assaults where bots try to guess usernames and passwords. You can limit who can see your login page by IP address.

• Stop anyone from trying to log in using physical force
• Stop bad bots and crawlers
• Lower the strain on the server, protect users’ privacy, and make the website run faster and be up more often.
• Limiting IP access isn’t a one-size-fits-all approach, but it works best for admin teams that work from the same place all the time.

IP restriction is a form of access control that limits access to certain parts of a website (like the login page) based on the IP address of the user trying to access it. You can either:

• Allow specific IPs (whitelisting)
• Block specific IPs (blacklisting)

In this article, we focus primarily on whitelisting for login page protection.

Before you begin, you need to know the IP address you want to allow.

To find your IP:

• Visit: https://whatismyipaddress.com
• Note down your public IPv4 address (e.g., 192.0.2.1)

If your IP changes often (dynamic IP), you may want to consider alternative solutions like VPNs or DNS-based filtering.

If your WordPress site is hosted on an Apache server, you can easily restrict access using the .htaccess file.

Steps:

1. Access your site via FTP or a File Manager in your hosting control panel.
2. Locate the .htaccess file in the root directory of your WordPress installation.
3. Add the following code at the top:

<Files wp-login.php>

    Order Deny,Allow

    Deny from all

    Allow from YOUR.IP.ADD.RESS

</Files>

Replace YOUR.IP.ADD.RESS with your actual IP address. You can list multiple Allow from lines for different IPs.

To restrict the admin dashboard as well:

<Directory /wp-admin>

    Order Deny,Allow

    Deny from all

    Allow from YOUR.IP.ADD.RESS

</Directory>

Note: Make sure you don’t block yourself from logging in!

For sites running on NGINX, you need to modify the server configuration file:

location = /wp-login.php {

    allow YOUR.IP.ADD.RESS;

    deny all;

}

location ~* ^/wp-admin/ {

    allow YOUR.IP.ADD.RESS;

    deny all;

}

After editing the config file, restart NGINX:

sudo systemctl restart nginx

Make sure your syntax is valid before restarting.

For those who don’t want to modify server files, several WordPress plugins offer IP whitelisting features:

iThemes Security

• Offers brute-force protection and login page hiding
• Allows IP whitelisting for admin access

Wordfence Security

• Built-in firewall and malware scanner
• Options for country blocking and IP access control

All In One WP Security & Firewall

• Simple UI for adding IP rules
• Protects login pages and admin directories

These plugins also log failed login attempts and notify you about suspicious behavior.

If your IP changes frequently or you’re working with a team spread across multiple locations, you can set up access control with Cloudflare:

Steps:

1. Sign up and connect your domain to Cloudflare.
2. Navigate to Firewall > Tools.
3. Set a rule to allow or block IPs or IP ranges.
4. Use Page Rules to restrict access to wp-login.php based on IP.

Cloudflare acts as a proxy, so your real IP restriction should align with the X-Forwarded-For header.

Another method is to add basic HTTP authentication on top of the WordPress login page:

How to Set It Up:

1. Create a .htpasswd file using htpasswd generator
2. Upload it to a secure directory
3. Edit .htaccess:

<Files wp-login.php>

    AuthType Basic

    AuthName “Restricted Access”

    AuthUserFile /full/path/to/.htpasswd

    Require valid-user

</Files>

This creates a login prompt before users even reach the WordPress login screen.

Pros:

• Strong protection against brute-force attacks
• Easy to implement with .htaccess or plugins
• Enhances overall site security

Cons:

• Not ideal for users with dynamic IPs
• Could block legitimate users by mistake
• Requires manual updates for new IPs

• Always test IP rules before finalizing
• Combine with two-factor authentication (2FA)
• Maintain a backup admin account with broader access in case of lockout
• Log and monitor access attempts
• Update your IP rules regularly

If IP restriction seems too rigid, you can hide or change your login URL using plugins like:

• WPS Hide Login
• iThemes Security (Login Slug feature)

Changing wp-login.php to something unique makes brute-force targeting much harder.

For comprehensive protection:

• Use IP restriction plus strong passwords
• Add CAPTCHA to login forms
• Enable 2FA
• Install firewall plugins (Wordfence, Sucuri)
• Regularly scan your site for malware

Access control in businesses commonly works using VPNs and limits on the company’s own network. In these situations, IP restriction is done at the firewall or VPN level instead of in WordPress or on the server itself. This puts control in one place and makes it easy to administer access controls for big teams.

Companies with remote workers may choose to whitelist certain ranges of dynamic IPs or utilize zero-trust architectures, which check login attempts based on user behavior and geolocation to make security even stronger.

Some shared hosting environments don’t give access to .htaccess, but support .user.ini files. You can still implement basic PHP-based IP restrictions in your wp-login.php or via functions.php:

if ($_SERVER[‘REMOTE_ADDR’] != ‘YOUR.IP.ADD.RESS’) {

    wp_die(‘Access Denied’);

}

While less secure than server-level restrictions, it’s a viable option when other methods aren’t available.

To track who’s trying to access your login page, enable logging on your server or use plugins that log IP addresses and failed login attempts. Tools like WP Activity Log, WP Security Audit Log, and custom NGINX/Apache logs can provide detailed insights into attempted breaches.

Regularly reviewing these logs can help you identify IPs that should be blocked or reported.

It’s important to teach your team or clients about safe login habits as well as set technological limits. Show them how to use strong, unique passwords, stay away from public Wi-Fi while signing in, and turn on two-factor authentication. Everyone who can get to the site should be responsible for keeping it safe.

Limiting access to your WordPress login page by IP address is a clever and practical way to lower the number of illegal login attempts and make your site more secure. This method isn’t perfect or flawless for every setup, but when used with other security measures like two-factor authentication (2FA), strong passwords, and monitoring, it makes WordPress more secure.

You can use .htaccess, NGINX, plugins, or Cloudflare, depending on how your server is set up and who your users are. And most importantly, make sure your site’s security is always changing and getting better.

Following this advice will make your WordPress login page much harder to hack, which is one of the most popular ways that hackers get into websites nowadays.