[{"data":1,"prerenderedAt":10},["ShallowReactive",2],{"$fqxsi0p85p51j":3},{"slug":4,"title":5,"description":6,"published":7,"updated":7,"thumb":8,"html":9},"securing-wp-admin","Securing wp-admin","Securing wp-admin Adding server-side password protection (such as BasicAuth) to \u002Fwp-admin\u002F adds a second layer of protection around your blog’s admin...","2016-06-17",null,"\u003Cp>Securing wp-admin\u003Cbr \u002F>\nAdding server-side password protection (such as BasicAuth) to \u002Fwp-admin\u002F adds a second layer of protection around your blog’s admin area, the login screen, and your files. This forces an attacker or bot to attack this second layer of protection instead of your actual admin files. Many WordPress attacks are carried out autonomously by malicious software bots.\u003C\u002Fp>\n\u003Cp>Simply securing the wp-admin\u002F directory might also break some WordPress functionality, such as the AJAX handler at wp-admin\u002Fadmin-ajax.php. See the Resources section for more documentation on how to password protect your wp-admin\u002F directory properly.\u003C\u002Fp>\n\u003Cp>The most common attacks against a WordPress blog usually fall into two categories.\u003C\u002Fp>\n\u003Cp>Sending specially-crafted HTTP requests to your server with specific exploit payloads for specific vulnerabilities. These include old\u002Foutdated plugins and software.\u003Cbr \u002F>\nAttempting to gain access to your blog by using \"brute-force\" password guessing.\u003Cbr \u002F>\nThe ultimate implementation of this \"second layer\" password protection is to require an HTTPS SSL encrypted connection for administration, so that all communication and sensitive data is encrypted. See Administration Over SSL.\u003C\u002Fp>",1793901039234]