Please stop password protecting your /wp-admin folder because it breaks public AJAX for WordPress.
There are many helpful articles like this one that explain how to add “another level of security” to your website by password protecting access to the /wp-admin folder.
The trouble with doing this is that you break ALL ajax in WordPress for non-logged in users.
Note 2: Both front-end and back-end Ajax requests use admin-ajax.php
Remember, admin-ajax.php lives in /wp-admin/admin-ajax.php.
So by password protecting that directory you’re blocking access to that script which means that all publicly accessible AJAX functionality for WordPress breaks.
Every week I get an email or two from someone who has password protected this directory and wonders why a specific function in our plugin (that relies on a public ajax handler) doesn’t work and I have to explain the above.
Trust Your Site to the Leader in WordPress Security
Wordfence includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Discover why over 5 million WordPress sites put their trust in Wordfence.
Well, wouldn't it be easier if WordPress moved the non-admin ajax out of the /wp-admin/ directory?
mark
May 9, 2014 10:43 am
Yes agreed, but that's a huge change that comes with it's own challenges.
Regards,
Mark.
Rishi
May 12, 2014 6:47 am
Hi,
Just curious what Wordfence uses this Ajax for. I password protected my wp-admin folder (on my test site) for security reasons, and prefer it to stay this away depending on what Wordfence needs to do. The admin-ajax.php is not currently accessible, so every page has a /wp-admin/admin-ajax.php?action=wordfence_logHuman&... request that is currently not accesible.
My question is: Do I need to keep this and what is the advantage, because my test blog seems to work OK without it (for non-admin users).
Of course as it is most likely needed, we are checking to see how to allow only that file, yet password protect the rest of the wp-admin folder.
Many thanks
TeeDev
May 19, 2014 11:16 pm
The Wpbeginner article you linked to also contains an additional section which explains how to exclude admin-ajax.php from HTTP-AUTH, is that not working for you? It's worked for me for over a year and my ajaxified plugins work without issue for non-logged-in users.
Matt
July 31, 2014 9:09 am
You can still password protect the admin. Just allow access to admin-ajax in the wp-admin .htaccess file with this rule:
Order allow,deny
Allow from all
Satisfy any
Donato Barragan
May 22, 2015 6:35 am
Hello
Solved, adding at file public_html/wp-admin/.htaccess
Following lines:
# Allow plugin access to admin-ajax.php around password protection
Order allow,deny
Allow from all
Satisfy any
I don´t have more the problem, and the wp-admin folder continues protected.
Regards!
Krzysiek Dróżdż
August 17, 2015 12:31 am
Well, if password protecting wp-admin breaks AJAX calls it means, that it's done incorrectly. You should always allow admin-ajax.php calls without password. And it's really easy to do - just add these lines to your .htaccess file:
Order allow,deny
Allow from all
Satisfy any
But asking people not to password protect wp-admin just because some of them do it wrong is a really bad advice. Especially if it comes from people involved in WordPress security...
Krzysiek Dróżdż
August 17, 2015 12:32 am
Well, it should be:
<Files admin-ajax.php>
Order allow,deny
Allow from all
Satisfy any
</Files>
Kim
June 6, 2017 6:39 am
THANK YOU! Huge help!
ian
November 3, 2015 5:42 am
Hi, I would love to hear Mark's thoughts on protecting it, but with the exception for Ajax. Is it still a bad idea? Is it a worthless exercise? Or does it convey some hardening?
I don't know
Gabriel
November 6, 2015 7:08 pm
Just password protect wp-login.php, problem solved
ian
November 16, 2015 5:18 am
Hi, I did have that file password protected, but still I got hacked. Somehow, the toads managed to upload a fake French bank site to my wp-includes folder. All of that was before i found wordfence, and fortunately nothing bad since, but I did do a lot of reading after that, some of which Mark now says is a bad idea.
I now don't know what to do - I can see his point, but my ajax is working apparently fine with a wp-admin protected directory.
I guess I will take his advice, and remove that protection, but I am a bit nervous to do so!!
Daniel Crabbe
June 19, 2017 3:14 am
I have to password protect wp-admin/ but allow permissions to admin ajax via .htaccess. Works fine. Its not so much actual hacks but the sheer volume of bots loading wp-login.php and trying to login.
Breaking WordPress Security Research in your inbox as it happens.
This website uses cookies, pixels, and similar technologies (collectively “Cookies”) to improve your browsing experience. By clicking “Accept All”, you agree to the storing of Cookies on your device and that we may share, track, store, and analyze your interactions with the website to enhance site navigation, analyze site usage, and assist in our marketing efforts. For more information on our use of cookies please review our Cookie Policy.
Cookie Options
For additional information on how this site uses cookies, please review our Privacy Policy. The cookies used by this site are classified into the following categories and can be configured below.
Strictly Necessary
Always active
The “Strictly Necessary” cookies are necessary for the Sites and Services to work properly, and cannot be disabled. They include any essential authentication and authorization cookies for the Services. If you select the “Reject All” button, or choose to do nothing, only the strictly necessary cookies are active by default.
Functional
Disabled via "Do Not Sell or Share My Information" request. This category cannot be enabled.
Your browser is sending a Global Privacy Control signal which automatically disables this category. You may change your browser settings to enable it.
These cookies allow us to remember choices you make, such as your username, language, or region. This helps provide a more personalized and consistent experience by tailoring the Services to your preferences. For example, we can remember your preferred settings or login details, so you don't have to re-enter them each time you visit.
Performance/Analytical
Disabled via "Do Not Sell or Share My Information" request. This category cannot be enabled.
Your browser is sending a Global Privacy Control signal which automatically disables this category. You may change your browser settings to enable it.
These Cookies allow us to collect certain information about how you navigate the Sites or utilize the Services running on your device. They help us understand which areas you use and what we can do to improve them.
Targeting
Disabled via "Do Not Sell or Share My Information" request. This category cannot be enabled.
Your browser is sending a Global Privacy Control signal which automatically disables this category. You may change your browser settings to enable it.
These Cookies are used to deliver relevant information related to the Services to an identified machine or other device (not a named or otherwise identifiable person) which has previously been used to visit our Sites. Some of these types of Cookies on our Sites are operated by third parties with our permission and are used to identify advertising sources that are effectively driving customers to our Sites.
Do Not Sell or Share My Personal Information
This form enables you to request that we stop selling or sharing your personal information with third parties. "Selling" includes exchanging your information for money or other benefits, while "sharing" refers to providing your data to third parties for targeted advertising purposes. For more information on how we process personal information, please review our Privacy Notice.
When you submit this form, we will:
Immediately disable retargeting and remarketing cookies on your current browser/device
Browser/Device Specific: This opt-out applies to the specific browser from which you submit the request. To opt out on additional devices or browsers, you will need to submit separate requests.
Cookie Management: You may also manage cookies directly through your browser settings, or on our Cookie Control form.
Your request has been received. We will no longer share or sell your personal information on this browser.
An error occurred while attempting to submit your request. Please try again or contact support.
Comments
4:12 am
Well, wouldn't it be easier if WordPress moved the non-admin ajax out of the /wp-admin/ directory?
10:43 am
Yes agreed, but that's a huge change that comes with it's own challenges.
Regards,
Mark.
6:47 am
Hi,
Just curious what Wordfence uses this Ajax for. I password protected my wp-admin folder (on my test site) for security reasons, and prefer it to stay this away depending on what Wordfence needs to do. The admin-ajax.php is not currently accessible, so every page has a /wp-admin/admin-ajax.php?action=wordfence_logHuman&... request that is currently not accesible.
My question is: Do I need to keep this and what is the advantage, because my test blog seems to work OK without it (for non-admin users).
Of course as it is most likely needed, we are checking to see how to allow only that file, yet password protect the rest of the wp-admin folder.
Many thanks
11:16 pm
The Wpbeginner article you linked to also contains an additional section which explains how to exclude admin-ajax.php from HTTP-AUTH, is that not working for you? It's worked for me for over a year and my ajaxified plugins work without issue for non-logged-in users.
9:09 am
You can still password protect the admin. Just allow access to admin-ajax in the wp-admin .htaccess file with this rule:
Order allow,deny
Allow from all
Satisfy any
6:35 am
Hello
Solved, adding at file public_html/wp-admin/.htaccess
Following lines:
# Allow plugin access to admin-ajax.php around password protection
Order allow,deny
Allow from all
Satisfy any
I don´t have more the problem, and the wp-admin folder continues protected.
Regards!
12:31 am
Well, if password protecting wp-admin breaks AJAX calls it means, that it's done incorrectly. You should always allow admin-ajax.php calls without password. And it's really easy to do - just add these lines to your .htaccess file:
Order allow,deny
Allow from all
Satisfy any
But asking people not to password protect wp-admin just because some of them do it wrong is a really bad advice. Especially if it comes from people involved in WordPress security...
12:32 am
Well, it should be:
<Files admin-ajax.php>
Order allow,deny
Allow from all
Satisfy any
</Files>
6:39 am
THANK YOU! Huge help!
5:42 am
Hi, I would love to hear Mark's thoughts on protecting it, but with the exception for Ajax. Is it still a bad idea? Is it a worthless exercise? Or does it convey some hardening?
I don't know
7:08 pm
Just password protect wp-login.php, problem solved
5:18 am
Hi, I did have that file password protected, but still I got hacked. Somehow, the toads managed to upload a fake French bank site to my wp-includes folder. All of that was before i found wordfence, and fortunately nothing bad since, but I did do a lot of reading after that, some of which Mark now says is a bad idea.
I now don't know what to do - I can see his point, but my ajax is working apparently fine with a wp-admin protected directory.
I guess I will take his advice, and remove that protection, but I am a bit nervous to do so!!
3:14 am
I have to password protect wp-admin/ but allow permissions to admin ajax via .htaccess. Works fine. Its not so much actual hacks but the sheer volume of bots loading wp-login.php and trying to login.