我正在努力了解如何保护WordPress网站。我不明白的一个安全任务是。。。How important is it to protect the "wp-admin folder"? 例如，我认为限制登录尝试非常重要。

保护wp admin文件夹的目的是什么？是为了防止黑客进入你的WordPress仪表板吗？But if you protect wp-login.php, how would a hacker even get into the dashboard anyways?

<Files wp-login.php>
order deny,allow
deny from all
allow from xxx.xxx.x.x
</Files>

If you use "Code A" will you also need to whitelist frontend AJAX functionality, and whitelist install.css ?

AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName "WordPress Admin Access Control"
AuthType Basic
<LIMIT GET>
order deny,allow
deny from all
allow from xx.xx.xx.xxx
</LIMIT>

“代码B”-保护wp管理目录

1   # enable basic authentication
2   AuthType Basic
3   # this text is displayed in the login dialog
4   AuthName “Restricted Area”
5   # The absolute path of the Apache htpasswd file. You should edit this
6   AuthUserFile /path/to/.htpasswd
7   # Allows any user in the .htpasswd file to access the directory
8   require valid-user




Allow front end Ajax functionality


Some WordPress plugins use Ajax functionality in WordPress.  
This means that such plugins might need access to the file admin-ajax.php  
To allow anonymous access to such file for the WordPress plugins to function,  
add the below to .htaccess  

1   <Files admin-ajax.php>
2       Order allow,deny
3       Allow from all
4       Satisfy any
5   </Files>



Update: /wp-admin/css/install.css is also sometimes needed on the frontend,  
you should whitelist that as well. Here\'s the necessary configuration 
to whitelist a file in a password protected location in lighttpd:


$HTTP["url"] =~ "^\\/wp-admin\\/.*" {
    $HTTP["url"] !~ "^\\/wp-admin\\/(admin-ajax\\.php|css\\/.*)" {
        auth.require = (
            "" => (
                "method" => "basic",
                "realm" => "Password protected area",
                "require" => "user=theuser",
            ),
        ),
    },
},