Actually the codex should be updated to use this instead.
# Block access to wp-admin.
order allow,deny
allow from x.x.x.x
This is much more efficient. Because you are whitelisting instead of blacklisting.
Quoted from Apache.org:
Allow,Deny
First, all Allow directives are evaluated; at least one must match, or the request is rejected. Next, all Deny directives are evaluated. If any matches, the request is rejected. Last, any requests which do not match an Allow or a Deny directive are denied by default.
https://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#order
If you want to protect wp-login.php you could do much more with mod_rewrite than using mod_authz_host. You could block anything that’s not using common HTTP methods, like Header Requests which most bots don’t do or when they do them they are some crazy format or string. Well you could do it using mod_authz_host to, but it requires more work.
This is just an example and only has a few conditions (I can’t give away all of my secrets) but here you go:
RewriteEngine On
RewriteCond %{THE_REQUEST} !HTTP/1\.1$ [NC,OR]
RewriteCond %{HTTP:Connection} !^keep-alive$ [NC,OR]
RewriteCond %{HTTP:Accept-Encoding} !^gzip [NC,OR]
RewriteCond %{HTTP:Accept-Language} ^.?$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.?$ [OR]
RewriteCond %{HTTP_ACCEPT} ^.?$
RewriteRule wp-login\.php https://example\.com [R=301,L,NS]
I can think of quite a few more things to add to that if you’re the only person logging in. You could add IP, a specific Firefox User Agent, a min/max on a User Agent string, a custom User Agent that only you know, other known headers used by bots etc. If you have a Cookie set up, you could include it as well.
This is on that codex. I wouldn’t recommend this for sites that are community based and requiring registration before logging in.
# Stop spam attack logins and comments
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .(wp-comments-post|wp-login)\.php*
RewriteCond %{HTTP_REFERER} !.*example.com.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule (.*) https://%{REMOTE_ADDR}/$ [R=301,L]
</ifModule>
Why do I say that? Because if a user has to confirm registration via email, once they clicked that link to confirm registration they will be kicked back to themselves and will never be able to register/login because they will not have the site URL as a referrer. Granted they might be able to get their password, than just go back to the site without using the link in their email. But many won’t do that. They’ll click the link in their email and when they can log in, they’ll probably never figure it out. Been there, done that unfortunately.
