Your WordPress admin dashboard is the control center of your website, and one of the most targeted areas by hackers and bots. If left unprotected, it becomes an easy entry point for brute-force attacks, login attempts, and malicious scripts. That’s why it’s essential to restrict WordPress admin access and ensure only trusted IP addresses can reach your /wp-admin or login page. Whether you’re running a blog, eCommerce store, or client website, securing the admin area should be a top priority. In this guide, we’ll walk you through multiple methods to restrict access by IP address using tools like Fail2Ban, WordPress security plugins, and .htaccess file editing, all easily manageable through ServerAvatar. 

In this guide, we’ll show you three effective methods to restrict WordPress admin access by IP address using ServerAvatar:

• Using the File Manager (.htaccess method)
• Using the Fail2Ban method
• Using a Security Plugin

Why Restrict Access by IP?

Limiting WordPress admin access to specific IP addresses ensures that only authorized users from predefined locations can reach your login page. This:

• Prevents brute-force attacks
• Reduces load on your server
• Increases overall security

Method 1: Restrict Access via .htaccess (File Manager in ServerAvatar)

This method restricts access directly using the .htaccess file.

Step-by-Step:

Step 1: Open File Manager in ServerAvatar

1. Go to your WordPress Application in ServerAvatar dashboard.
2. Go to File Manager.
3. Navigate to the root of your WordPress site (/public_html/wp-admin).

Step 2: Edit/Create .htaccess File in /wp-admin

<Limit GET POST>
order deny,allow
deny from all
allow from 123.45.67.89
</Limit>

<Limit GET POST>
order deny,allow
deny from all
allow from 123.45.67.89
</Limit>

Add or Replace IP Address you want to allow

• <Limit GET POST>
   Specifies that the following rules apply only to GET and POST HTTP methods (i.e., standard browser requests).
  
• order deny,allow
  Defines the evaluation order:
  deny rules are processed first,
  allow rules are processed second.
  So, by default, access is denied unless explicitly allowed.
  
• deny from all
  Denies access to everyone by default.
  
• allow from 123.45.67.89
   Grants access only to the IP address 123.45.67.89.
  
• </Limit>
  Ends the limitation block.

Step 3: Save the File

That’s it! Now only allowed IPs can access the admin directory.

Method 2 :- With Command Line Step-by-Step Guide to Restrict Access

Step 1: Connect to Your Server

If you have SSH access, connect to your server:
Enter your user name and server ip 

ssh username@your-server-ip

ssh username@your-server-ip

Navigate to your WordPress root directory:

cd /var/www/html

cd /var/www/html

This path might be different depending on your server setup.

Step 2: Edit .htaccess in the WordPress Root Directory

Open the .htaccess file:

nano .htaccess

nano .htaccess

Add this code at the top to restrict access to the login page:

<Files wp-login.php>
    Order Deny,Allow
    Deny from all
    Allow from 123.45.67.89
</Files>

<Files wp-login.php>
    Order Deny,Allow
    Deny from all
    Allow from 123.45.67.89
</Files>

 To allow multiple IPs:

<Files wp-login.php>
    Order Deny,Allow
    Deny from all
    Allow from 123.45.67.89
    Allow from 123.54.76.98
</Files>

<Files wp-login.php>
    Order Deny,Allow
    Deny from all
    Allow from 123.45.67.89
    Allow from 123.54.76.98
</Files>

Save the file and exit.

Step 3: Protect /wp-admin Directory

Now, navigate to the wp-admin folder:

cd wp-admin

cd wp-admin

Edit or create a .htaccess file:

nano .htaccess

nano .htaccess

Paste the following:

Order Deny,Allow
Deny from all
Allow from 123.45.67.89

Order Deny,Allow
Deny from all
Allow from 123.45.67.89

Save and exit.

Step 4: Restart  (if required)

Although .htaccess takes effect immediately, restarting  ensures rules are properly applied:

sudo systemctl restart apache2

sudo systemctl restart apache2

Restrict WordPress Admin Access via IP using Fail2Ban in ServerAvatar

Fail2Ban is an application-level tool that blocks malicious IPs after too many failed login attempts. When combined with ServerAvatar, it becomes easy to manage and configure.

Step-by-Step:

Step 1: Configure Fail2Ban from ServerAvatar Panel

1. Go to your Server Dashboard in the ServerAvatar Panel.
2. Click on the application section and go to your application dashboard. 
3. Select your WordPress Application, and navigate to the application dashboard.

4. Navigate to the Fail2Ban from the lefthand sidebar.  

Step 2: Create a Custom Fail2Ban configuration for WordPress

1. SSH into your server (use the SSH access feature inside ServerAvatar).
2. Create a custom jail:
3. Add the following config:

[MyWPapp]

enabled = true
filter = MyWPapp
port = http,https
logpath = /home/clP9VQcVJ5g4Kv6D/MyWPapp/logs/access*log
maxretry = 1
bantime = 3600
findtime = 600

[MyWPapp]

enabled = true
filter = MyWPapp
port = http,https
logpath = /home/clP9VQcVJ5g4Kv6D/MyWPapp/logs/access*log
maxretry = 1
bantime = 3600
findtime = 600

• Logpath= Add your access logpath for your application. Here mine is “/home/clP9VQcVJ5g4Kv6D/MyWPapp/logs/access*log”. change it to your appropriate log path. If you are using ServerAvatar, there is no need to change the logpath.
• bantime = This means permanent ban.
• All other IPs will be banned after 1 failed attempt (maxretry = 1).
• findtime = 60: Ban after failure within 10 seconds.
• Adjust port, logpath, and filter based on the service you’re protecting (like Nginx or FTP).

Step 3: Add Ignore IP:

• Add the IP address to the Ignore IP after saving the Fail2ban configuration. This will not block the ignored IP address as fail2ban will allow the IP address to login to the wp-admin.

• Navigate to the Ignore IP section. Click on the “Add an IP”, and add the IP address to ignore the IP Address.

Step 4: Restart Fail2Ban

Navigate to the Services section, Locate Fail2Ban Service, and click the Restart button to restart the Fail2Ban service. 

Done! Fail2Ban will now ban IPs after failed login attempts.

Tips:

• You can find your IP by searching “what’s my IP” on Google.
• If your IP changes often (dynamic IP), use the plugin method instead.
• Don’t block yourself, always allow your current IP before applying rules.

Restrict Access Using a WordPress Security Plugin

Plugins like Wordfence, All In One WP Security & Firewall, or iThemes Security make it easy to limit access to /wp-admin.

1. With Wordfence Plugin:

1. Install and activate Wordfence Security.
2. Go to Wordfence > Firewall > Blocking.
3. Use the IP blocking feature to allowlist your own IP and block unknown IPs from accessing login and admin URLs.

Key Features:-

• Web Application Firewall (WAF)
• Malware Scanner
• Two-Factor Authentication (2FA)
• CAPTCHA Protection
• Limit Login Attempts
• Real-time Threat Defense Feed
• Country Blocking
• Live Traffic Monitoring
• IP Blocking
• File Change Detection
• Security Incident Recovery Tools
• Scheduled Security Scans
• One-Click File Repair
• Leaked Password Protection
• Brute Force Protection
• Detailed Security Reports
• Centralized Site Management (Wordfence Central)
• Manual and Automatic Blocking
• Malware Signature Updates
• WHOIS Lookup for Suspicious IPs
• Audit of Core File Changes
• Email Alerting System
• Rate Limiting
• Block Fake Google Crawlers
• Block Vulnerable Plugins and Themes
• Firewall Rule and Scan Configuration
• Login Attempt Logging
• IPv6 Compatibility

2. With All In One WP Security Plugin:

1. Go to WP Security > Brute Force > Login Whitelist.
2. Add your IP address to allow access.
3. Enable login whitelist settings.

This method is easy, especially for non-technical users.

Key Feature:-

• User Account Security
• User Login Security
• User Registration Security
• Database Security
• File System Security
• .htaccess and wp-config.php File Backup
• Blacklist Functionality
• Firewall Protection
• Brute Force Login Attack Prevention
• Login Lockdown Feature
• Login Honeypot
• Force Logout for Idle Users
• Two-Factor Authentication (2FA)
• Google reCAPTCHA Integration
• Password Strength Enforcement
• Change WordPress Login URL
• Database Table Prefix Changer
• File Permission Checker
• Copy Protection for Content
• Prevent Hotlinking
• Disable Right Click
• Prevent Fake Googlebots
• Comment Spam Security
• Front-end Text Copy Protection
• Custom .htaccess Rules
• XML-RPC Protection
• Pingback Protection
• iFrame Protection
• WHOIS Lookup
• Failed Login Records
• Security Scanner
• Maintenance Mode Feature
• Security Strength Meter
• Automatic Lockout for Too Many Failed Logins
• Email Notifications for User Lockouts
• Country Blocking (via add-ons or integration)
• Login Activity Monitoring
• Security Logs Viewer

FAQ