How to Restrict Access to Your WordPress wp-admin by IP Address

You can stop almost everyone from even reaching your WordPress login page by restricting wp-admin and wp-login.php to a short list of approved IP addresses. Anyone connecting from outside that list sees a blocked page before they ever get a chance to enter a username or password. This is a stronger layer of protection than a password alone, since it blocks the login screen itself rather than just checking credentials.

This is most practical if you or your small team work from a fixed office IP address, a site-to-site VPN, or a home connection that doesn't change often. If your IP address changes frequently (common with some mobile and home broadband connections in Kenya), check your current IP before you start, and read the warning below before you save any changes.

Before you continue, find your current public IP address by searching "what is my IP" in your browser. Write it down. If you lock out the wrong address, you won't be able to log in to fix it yourself and will need to contact support to restore the file.

Method 1: Block by IP using a .htaccess file

This method edits a small text file inside your WordPress installation's wp-admin folder. The rules are identical whether you're on cPanel or DirectAdmin; only the way you open File Manager differs.

In cPanel

1. Log in to cPanel and open File Manager.
2. Navigate to public_html (or the subfolder where WordPress is installed), then open the wp-admin folder.
3. Click + File to create a new file named .htaccess if one doesn't already exist in this folder, or open the existing one for editing.

In DirectAdmin

1. Log in to DirectAdmin and open File Manager.
2. Navigate to your domain's public_html folder, then open the wp-admin folder.
3. Create or edit the .htaccess file inside that folder using the built-in file editor.

Add the following to the .htaccess file inside wp-admin, replacing the example addresses with your own approved IP addresses, one per line:

1. order deny,allow
2. deny from all
3. allow from 123.45.67.89
4. allow from 98.76.54.32

Save the file. From now on, only requests from the IP addresses you listed can load any page inside wp-admin, including the login form. Everyone else gets a "Forbidden" error.

This method does not cover wp-login.php, which sits outside the wp-admin folder, in your site's root. If you want the login page itself blocked too, add a second, separate rule in the root .htaccess file that targets requests to wp-login.php specifically, using the same allow from lines, or use Method 2 below, which handles both automatically.

Method 2: Use a security plugin instead

If editing server files isn't something you're comfortable with, a WordPress security plugin can do the same job from inside your dashboard. Most popular security plugins include a feature to:

• Restrict wp-admin and the login page to a list of IP addresses you enter in the plugin's settings.
• Automatically detect and apply the change without you touching any server files.
• Let you remove or update allowed IPs quickly from the dashboard if your address changes.

This is generally the safer option if your team's IP address isn't fixed, since you can update the allowed list yourself without needing File Manager access.

If you lock yourself out

If you apply the .htaccess method and then can't reach wp-admin yourself, go back into File Manager (using the steps above) and either remove the rules you added or add your current IP address to the allow list. If you're not sure how to get back into File Manager, open a support ticket and ZIPROF can help you remove the restriction.

For a broader look at protecting your WordPress login, see how to limit login attempts and protect your WordPress login from brute-force attacks.