How to limit WordPress admin access

How to restrict WordPress Administration Panel access

The following methods allow you to restrict access to your WordPress Administration Panel/Dashboard:

• Method #1: Restrict WordPress Administration Panel access with .htaccess
• Method #2: Restrict WordPress Administration Panel access using the Apache configuration file
• Method #3: Restrict WordPress Administration Panel access using the NGINX configuration file
• Method #4: Restrict WordPress Administration Panel access by changing user roles and permissions
• Method #5: Restrict WordPress Administration Panel access using code
• Method #6: Restrict WordPress Administration Panel access with a plugin

Method #1: Restrict WordPress administration panel access with .htaccess

Do you need to let just a few users access your WordPress Administration Panel? In that case, you can restrict access to specific IP addresses by changing your .htaccess file.

This action will prevent people with unknown IP addresses, such as hackers, from accessing the back end of your WordPress website. Do a complete backup before making any changes to this file.

Add the following code in the wp-admin/.htaccess file to restrict access.

For Apache 2.2

AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName "WordPress Administration Panel Access Control"
AuthType Basic
# ALLOW USER BY IP
<LIMIT GET>
order deny,allow
deny from all
allow from xx.xx.xx.xx
</LIMIT>

For Apache 2.4

AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName "WordPress Administration Panel Access Control"
AuthType Basic
# ALLOW USER BY IP
<Limit GET POST>
Require all denied
Require ip xx.xx.xx.xx
</Limit>

Don’t forget to replace xx.xx.xx.xx with the IP address or addresses you want to give admin panel access to.

Method #2: Restrict WordPress administration panel access using the Apache configuration file

You can add this code to the Apache configuration file to give WordPress Administration Panel access to trusted IP addresses.

<location /wp-admin>
allow from xx.xx.xx.xx
deny from all
</location>
<location /wp-login.php>
allow from xx.xx.xx.xx
deny from all
</location>

If you want to deny access to any IP address, paste this code into your Apache configuration file:

<location /wp-admin>
deny from xx.xx.xx.xx
allow from all
</location>
<location /wp-login.php>
deny from xx.xx.xx.xx
allow from all
</location>

Replace xx.xx.xx.xx with the IP address you want to deny admin panel access to. Reload Apache to ensure these changes are applied.

Method #3: Restrict WordPress administration panel access using the NGINX configuration file

Enter this code in your NGINX configuration file to give a particular IP address access to your WordPress Administration Panel:

location /wp-admin {
allow xx.xx.xx.xx;
deny all;
}
location = /wp-login.php {
allow xx.xx.xx.xx;
deny all;
}

Adding this code to your NGINX configuration file will deny access to an IP address of your choice:

location /wp-admin {
deny xx.xx.xx.xx;
allow all;
}
location = /wp-login.php {
deny xx.xx.xx.xx;
allow all;
}

Again, replace xx.xx.xx.xx with the IP address you want to keep out. Remember to reload NGINX to ensure these changes are applied.

Method #4: Restrict WordPress administration panel access by changing user roles and permissions

User roles manage the permissions for what a user can and can’t do on your WordPress website. The website administrator assigns roles to users. For example, writers and editors are given different roles on WordPress (for example, monitor comments, create pages, and write blogs).

The most restricted role is Subscriber, so it’s a good idea for you to assign all new users this role. Subscribers can only use your front-end features (for example, commenting) and update their profiles.

To set the default role for new users, you can go to Settings > General on your WordPress Administration Panel menu. You’ll see New User Default Role:

If you want to change the role of an existing user, go to Users > Find User. Click on Edit and select the role you wish to assign to that user:

Once you choose the role, click Save changes.

Here are the default user roles:

• Administrator: Complete access.
• Editor: Can edit website posts, settings, and comments.
• Author: Can only write blog posts and edit their own posts.
• Contributor: Similar to an author, but they can’t publish anything without an author’s or editor’s approval.
• Subscriber: Can only read and comment.

Method #5: Restrict WordPress administration panel access using PHP code

You also can add this PHP code to the functions.php file of your child themes to restrict WordPress Administration Panel access:

add_action( 'init', 'blockusers_init' );
function blockusers_init() {
if ( is_admin() && ! current_user_can( 'administrator' ) &&
! ( defined( 'DOING_AJAX' ) && DOING_AJAX ) ) {
wp_redirect( home_url() );
exit;
}
}

This code makes it so only administrators can access the back end of your WordPress website. Other users are redirected to the website’s homepage.

The above code is only active when someone is logged in to the dashboard. It isn’t applied to users who aren’t logged in (users must be logged in to access your dashboard).

Method #6: Restrict WordPress Administration Panel access with a plugin

You also can use a WordPress plugin to restrict user access. There exists a good number of options in this category of plugins. We will discuss just one of the most popular ones.

Using the Remove Dashboard Access plugin for WordPress

You can use the Remove Dashboard Access plugin to restrict user access. After you install the plugin, you can choose who has access to your WordPress Administration Panel in the Dashboard access controls section (for example, administrators only or authors and editors).

If your preferred access restrictions aren’t listed, you can take greater control of access using the Advanced option:

This plugin also lets you:

• Choose a redirect URL for forbidden users.
• Grant all users the ability to change their profile.
• Add a personalized login message.