Apache: Stealth 404 the admin area until authenticated via basic auth, then allow access
Posted
by
Kzqai
on Server Fault
See other posts from Server Fault
or by Kzqai
Published on 2014-08-20T21:23:30Z
Indexed on
2014/08/20
22:22 UTC
Read the original article
Hit count: 197
Given a administrative area with urls like this:
wp-admin/
wp-admin/whatever
wp-admin/another-page
wp-adminsecretlogin/
A standard basic-auth coverage would provide a username and password prompt on all three urls, and return a 403 on all failed auth attempts. This is a pretty obvious signal that something exists there, and thus is an invitation to script/brute force access.
I would like to instead, require basic auth everywhere, but when not authenticated, not prompt for username and password, and instead return a 404 not found error for all urls except a wp-adminsecretlogin/ url. At that individual-to-the-site url, basic auth could go through, and unlock the rest of the administrative functionality (though the standard application login would still be necessary).
How would I do that via apache .htaccess or .conf directives?
© Server Fault or respective owner
