How to restrict access to your admin area

Lock an admin area (for example /wp-admin) or a whole staging site so only you can reach it. There are two approaches, which you can combine: an IP allow-list, and HTTP basic authentication.

Before you start

• SSH access to the host - see SSH access.
• See custom Nginx configuration for how ~/nginx works.

Option 1: IP allow-list

Restrict a path to known addresses in ~/nginx/50main.conf:

location /admin/ {
    allow 203.0.113.10;
    deny all;
}

For allow/deny rules that cover a whole site rather than one path, see Block or allow IP addresses.

Option 2: HTTP basic authentication

Ask for a username and password, optionally letting trusted IPs skip the prompt.

1. Install the apache2-utils package (it provides htpasswd) by adding it to os_extra_packages and publishing:

   os_extra_packages:
     - apache2-utils

2. Generate a password file over SSH:

   htpasswd -c /var/www/prod/.secrets/htpasswd prod

   You are prompted for a password - use a long, complex one.
3. Enable it on a location in ~/nginx/50main.conf:

   location / {
       auth_basic "Restricted area";
       auth_basic_user_file /var/www/prod/.secrets/htpasswd;
   
       # optional: trusted IPs skip the login prompt
       allow 203.0.113.10;
       satisfy any;
   }

Apply and verify

tscli nginx reload

Visit the protected path: you should be asked to log in (or be allowed straight through from a trusted IP), and blocked otherwise.

Related

• Configure Nginx
• Block or allow IP addresses
• Installing extra OS packages
• Security hardening