To reduce public access to WordPress administration, make Nginx control access to both /wp-admin/ and /wp-login.php. You can allow only administrators’ public IP addresses, add HTTP Basic Authentication, or use both. Protecting only /wp-admin/ is incomplete: logged-out visitors are redirected to wp-login.php. And a blanket restriction on the admin directory can break features that use admin-ajax.php, so test your site before applying the change in production.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What hiding wp-admin does—and does not do
An Nginx access rule can stop an unapproved request before it reaches WordPress and PHP. That makes an allowlist or Basic Authentication a practical way to reduce exposure of the administration area and login endpoint. It does not make the site immune to attacks, and changing or obscuring a login URL is not a substitute for strong passwords, two-factor authentication, updates, and controls against abusive login attempts.
As an Amazon Associate I earn from qualifying purchases.
WordPress treats the administration area and login page as related but distinct paths. A logged-out request to /wp-admin/ redirects to wp-login.php. If your goal is to limit who can reach the login surface, protect both paths rather than relying on a rule for the admin directory alone.
The configuration below is a pattern to adapt, not a complete server configuration. The correct Nginx rules depend on your installation’s existing server block, whether it is single-site or multisite, and whether a CDN or reverse proxy sits in front of it. WordPress publishes separate Nginx patterns for single-site and multisite deployments; use the pattern that matches your installation and validate your changes in staging when possible.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
“Hide” therefore means “require an access decision before the request reaches WordPress,” not “make the URL cease to exist.” Someone who knows the endpoint may still request it, but Nginx can reject that request unless it meets your policy. Keep that distinction clear when evaluating the result of a scan or a browser test.
Choose an access-control method
| Method | What it requires | When it fits | Key consideration |
|---|---|---|---|
| IP allowlist | The public IP address or network used by each administrator | A small team that connects from stable office or VPN egress addresses | Administrators connecting from a different address may be denied until the allowlist is updated. |
| HTTP Basic Authentication | An Nginx password file and credentials for the additional prompt | Administrators who need an extra authentication barrier before WordPress login | It adds a separate credential prompt; it does not replace WordPress authentication. |
| Both controls | Allowed administrator networks plus Basic Authentication credentials | Teams that want requests restricted to known networks and an additional credential check | Keep the access rules explicit and test the combined behavior before rollout. |
Nginx supports Basic Authentication for a site section and allows it to be combined with IP controls. Its allow and deny directives are order-sensitive: rules are evaluated in sequence, so put permitted addresses before deny all. An address restriction is only useful if Nginx sees the administrator’s real client IP. When a CDN or reverse proxy is involved, check how client addresses are presented to the origin before relying on an allowlist.
An IP allowlist is straightforward when every administrator leaves through a known office or VPN address. Its operational cost is maintaining that list when an office connection changes, a VPN pool changes, or a person works elsewhere. It can also deny a legitimate administrator even though the WordPress account itself is valid. Gather the addresses from the network that actually reaches the server, rather than copying an address shown for a private workstation.
Basic Authentication introduces a prompt before the normal WordPress login screen. The user must pass both layers, so losing the Nginx credential and losing the WordPress credential are separate events. The password file must be readable by Nginx and managed through the method established for that host. If you use Basic Authentication on one protected path, apply the intended policy to the other protected path as well; otherwise the unprotected path can remain the easier entry point.
Using both controls is stricter, but it also creates two independent conditions that can cause an expected administrator to be denied. Decide in advance whether the policy is meant to require an allowed network and a valid Basic Authentication credential, and document who can change either one. Test the combined behavior from an allowed address before ending your maintenance session.
Add rules for the admin area and login endpoint
Place the locations inside the relevant Nginx server block. Replace the documentation-only example networks below with the real public IP addresses or network ranges your administrators use. Do not copy the example addresses as if they were your own.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →# Inside the relevant server block; replace example networks.
location ^~ /wp-admin/ {
allow 203.0.113.10;
allow 198.51.100.0/24;
deny all;
# For Basic Authentication, uncomment and configure both lines:
# auth_basic "WordPress admin";
# auth_basic_user_file /etc/nginx/.htpasswd;
}
location = /wp-login.php {
allow 203.0.113.10;
allow 198.51.100.0/24;
deny all;
# Apply the same Basic Authentication choice here if required:
# auth_basic "WordPress admin";
# auth_basic_user_file /etc/nginx/.htpasswd;
}The first location covers paths under /wp-admin/; the second matches the exact /wp-login.php endpoint. To use Basic Authentication instead of an IP allowlist, configure auth_basic and auth_basic_user_file in both locations and remove or revise the IP rules to match your intended policy. For both layers, keep the IP rules and enable the authentication directives in each location. The password-file path must point to a file available to Nginx and prepared for its authentication mechanism; use your host’s established method for creating and managing it.
These snippets show the access policy, not the rest of a WordPress server block. Keep your site’s existing routing and PHP handling intact. If your Nginx configuration already contains locations that overlap these paths, review how the new rules interact with them rather than pasting the example blindly.
The ^~ prefix in the example makes the admin-directory location a deliberate path rule, while the equals sign on the login location makes the login match exact. Those choices express the two different targets: a directory and one PHP endpoint. They do not replace the rest of the site’s routing, and they should remain consistent with the active WordPress server block.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Do not treat the placeholder ranges 203.0.113.10 and 198.51.100.0/24 as usable administrator addresses. They are documentation examples. A wrong real address can lock out every administrator, while an address representing a proxy rather than the user can make the rule broader than intended. Confirm what the origin logs and Nginx configuration identify as the client address.
Free tools Windows power users keep installed
One-click scans. No signup required.
For a multisite installation, do not assume that a single-site example is interchangeable with the multisite layout. WordPress provides separate Nginx patterns because the server block and rewrite arrangement can differ. Add the access policy to the server block that actually handles the multisite requests, preserving its existing routing and PHP behavior.
Roll out the change without locking yourself out
- Back up the active server block. Identify the configuration file or included file that actually serves the WordPress site. Also determine whether a CDN or reverse proxy changes the client IP Nginx sees.
- Choose the policy and gather real administrator addresses. Decide whether to use an IP allowlist, Basic Authentication, or both. Confirm the public egress addresses for the networks administrators will use; the example addresses in the snippet are documentation placeholders.
- Protect both paths. Add rules for
/wp-admin/and the exact/wp-login.phpendpoint in the relevant server block. Apply the same intended access policy to each. - Validate the configuration. Run
nginx -tbefore reloading. If Nginx reports a syntax or configuration error, do not reload the broken configuration; correct the reported issue and test again. - Reload using the host’s normal service procedure. The reload method varies by hosting environment, so use the procedure for your server rather than assuming a particular service manager or control panel.
- Test both sides of the rule. From an allowed administrator network, verify that the additional prompt behaves as expected, if enabled, and that WordPress login works. From a network that should be denied, verify that access to both paths is rejected.
- Test the WordPress flows that depend on those paths. Check the logged-out redirect, password reset, and plugin features that use
admin-ajax.php. Also check REST, XML-RPC, mobile-app, cron, and monitoring integrations before adding restrictions to any additional endpoints. - Keep a recovery path. Retain the backup and make sure you can edit or restore the active Nginx configuration through your host if an administrator is unexpectedly denied.
Perform the rollout while you still have an administrative session and an independent way to reach the host configuration. A successful syntax test proves that Nginx can parse the file; it does not prove that the rule is in the server block receiving your domain, that the proxy supplies the expected address, or that WordPress features still work. Those require separate tests.
A useful test matrix includes an allowed public address, a denied public address, a logged-out browser requesting /wp-admin/, a direct request to /wp-login.php, and a normal logged-in dashboard request. Repeat the checks with Basic Authentication enabled if you use it. Record which prompt or denial occurs so a later administrator can distinguish an IP-policy problem from a password-file problem.
After the initial rollout, repeat the checks when changing a CDN, VPN, office connection, WordPress core, a plugin, or the Nginx server block. Any of those changes can alter the request path or the address Nginx sees. Keep the backup until the new configuration has been exercised under normal administration and recovery conditions.
Prevent admin-ajax.php from breaking
Not every request under /wp-admin/ is an interactive administrator page. WordPress warns that securing the whole directory can break functionality, including the AJAX handler at wp-admin/admin-ajax.php. Plugins may rely on that endpoint for features used on public pages as well as in the dashboard.
After adding the restriction, exercise the site’s important plugin and theme features, not just the dashboard. If an AJAX-dependent feature fails, identify the exact request and determine whether it genuinely needs to remain reachable. A narrowly scoped exception or an authentication design that preserves the required endpoint may be appropriate, but a public exception changes the protection boundary: do not exempt the whole admin directory just to make a feature work. Keep the exception limited to the endpoint and behavior you have verified, and test it again after changes to plugins or the site’s Nginx routing.
There is no safe universal exception snippet for every WordPress server block: the endpoint must still follow the site’s existing PHP handling, and location precedence and routing vary with the rest of the configuration. Preserve the current PHP route when adding a narrowly scoped exception rather than copying a generic handler into production.
Check browser developer tools, application logs, or the plugin’s own diagnostics to identify the failing URL instead of guessing. A feature that appears to be an admin problem may call a different endpoint, and opening more of /wp-admin/ than necessary can undo the access boundary. Once you have identified the required request, document why it is needed and retest it from both an allowed and an ordinary public session.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Consider related integrations before restricting more paths
The admin and login locations are not the only WordPress interfaces that may be used by legitimate systems. The rollout checklist includes REST, XML-RPC, mobile-app, cron, and monitoring integrations because an administrator may depend on them even when a browser dashboard works. Check each integration before adding restrictions to additional paths; do not infer that it is safe to block every request containing “admin” in its URL.
Similarly, do not use a successful denial from an outside network as proof that all legitimate automation is unaffected. A monitoring service or scheduled process may originate from a different address than the administrators. Confirm its documented endpoint and source network, then decide separately whether it should remain reachable. The goal is a narrowly defined access policy, not an indiscriminate block that creates silent failures.
Common failure modes and what to check
Administrators are denied after deployment
Check that the allowlist contains the public address Nginx actually sees, not a private workstation address. If requests pass through a CDN or reverse proxy, confirm the origin’s client-IP handling before changing the allowed range. Also check for a changed office or VPN egress address and for an unintended rule order.
The login page still appears reachable
Confirm that the rule is in the server block serving the site and matches the exact /wp-login.php path. A rule for /wp-admin/ alone does not cover the login endpoint; the directory’s logged-out redirect is why both locations matter.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteA plugin or site feature stops working
Check whether its failing request targets wp-admin/admin-ajax.php. If so, review whether the broad admin rule is blocking a request the feature needs. Make only a narrow, tested adjustment that preserves the site’s existing PHP routing; do not remove protections from all of /wp-admin/ as a quick fix.
Nginx refuses the configuration
Run nginx -t and correct the configuration issue it reports before reloading. Verify that the locations are in a valid context, that the password-file path is correct if Basic Authentication is enabled, and that the edited file is included by the active server configuration.
A login-path plugin or redirect is being considered
A WordPress plugin can change or redirect the apparent login path, but that is an application-level choice that must be maintained with the plugin. It does not remove the need to understand the Nginx rules protecting the actual endpoints or to keep other security controls in place.
The policy works from one network but not another
Compare the public egress addresses and proxy path for both tests. An allowlist is based on what reaches Nginx, so a workstation’s local address or a browser’s apparent location is not sufficient evidence. Update only the verified network range and retest the denied case so the exception does not become unnecessarily broad.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsBasic Authentication behaves differently on the two paths
Inspect both location blocks and confirm that the same intended auth_basic and auth_basic_user_file settings are present where required. A credential prompt on one path does not imply that the exact login endpoint is protected. Test a direct request to each path, not only the redirect from the dashboard.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Keep the protection proportionate
Restricting access to known networks is most practical when administrator addresses are stable and the correct client IP reaches Nginx. Basic Authentication adds a credential barrier without requiring a fixed source address, while the combined approach applies both checks. Whichever method you choose, account for legitimate integrations and test the behavior after WordPress, plugin, or Nginx changes.
WordPress cautions that obscuring a login URL can reduce noise but should not be the only defense. Treat access rules as one layer: keep WordPress core and plugins updated, use strong credentials and two-factor authentication, and retain rate limiting or blocking for abusive login attempts. Restricting paths is intended to reduce exposure, not to make vulnerabilities or compromised credentials harmless.
The configuration principles here follow the WordPress.org and NGINX guidance available as of October 15, 2026. Because single-site and multisite Nginx layouts differ, validate the adapted server block against the pattern for your deployment.
Frequently asked questions
Should I protect only /wp-admin/?
No. A logged-out request to that directory redirects to wp-login.php, which is a separate endpoint. Add a rule for the admin directory and an exact-match rule for /wp-login.php.
Can I use Basic Authentication without an IP allowlist?
Yes. Configure auth_basic and auth_basic_user_file in both protected locations. Basic Authentication adds a separate prompt before WordPress authentication; it does not replace WordPress credentials.
Can I combine Basic Authentication and IP filtering?
Yes. Nginx supports combining the controls. Keep the allow entries before deny all, apply the intended authentication directives to both locations, and test the combined behavior from an allowed network.
Why did restricting wp-admin break a public feature?
The feature may use wp-admin/admin-ajax.php. WordPress specifically warns that securing the directory can break this handler. Identify the exact request and make only a narrowly scoped, tested adjustment that preserves existing PHP routing.
Recommended Free Tools
What if administrators use changing home or mobile addresses?
An IP allowlist may be impractical when addresses are not stable. Consider Basic Authentication as the additional access barrier, or use a stable VPN egress address, and verify what client address reaches Nginx when a proxy is involved.
Do the example IP addresses work?
No. 203.0.113.10 and 198.51.100.0/24 are documentation placeholders. Replace them with the real public addresses or networks used by your administrators.
Does this configuration cover multisite?
The access principle applies, but the surrounding Nginx server block and routing can differ. Use the WordPress pattern for the actual single-site or multisite layout and preserve its existing PHP handling.
How do I verify the change safely?
Back up the active configuration, run nginx -t, reload through the host’s normal procedure, and test allowed and denied networks. Also test the redirect, password reset, admin-ajax.php, REST, XML-RPC, mobile-app, cron, and monitoring integrations before tightening more paths.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Bottom line
Use Nginx to enforce a deliberate policy on both /wp-admin/ and /wp-login.php. Choose an IP allowlist, Basic Authentication, or both according to how administrators connect, verify the client IP seen by the origin, and preserve the existing WordPress routing. Validate with nginx -t, test from allowed and denied networks, and check admin-ajax.php and other integrations before considering the rollout complete. This reduces unwanted exposure, but it remains one layer alongside updates, strong credentials, two-factor authentication, and login-abuse controls.
Frequently Asked Questions
Should I protect only /wp-admin/?
No. Logged-out requests to /wp-admin/ redirect to the separate wp-login.php endpoint, so protect both paths.
Can Basic Authentication replace WordPress login?
No. It adds an Nginx credential prompt before the normal WordPress authentication flow.
Why did a plugin stop working after I blocked wp-admin?
It may depend on wp-admin/admin-ajax.php. Identify the exact request and create only a narrowly scoped, tested adjustment that preserves existing PHP routing.
What are the example IP addresses in the configuration?
They are documentation placeholders. Replace them with the real public addresses or network ranges that reach your Nginx server.
What should I test before reloading?
Back up the active server block, run nginx -t, then test allowed and denied networks, the login redirect, password reset, admin-ajax.php, and required REST, XML-RPC, mobile, cron, and monitoring integrations.
The Bottom Line
Protect both WordPress administration paths at Nginx, choose the access method that matches your network, and test dependent endpoints before deployment. Access rules reduce exposure but do not replace updates, strong credentials, two-factor authentication, or rate limiting.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
