I have used several rules to block wp-login.php with a htpassword. The htpassword module is working. I added it to root of the site and it worked. But wp-login.php is not working. Here’s my website http://www.digitalreborn.com/wp-admin
Here’s the passwd rule :
location ~* /wp-login.php {
auth_basic "Restricted Area: WordPress";
auth_basic_user_file /var/www/digitalreborn/.htpasswd;
try_files $uri =404;
fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
}
Try this approach:
Then on your nginx virtual host conf.
Then restart the service:
403 Forbidden after correct login: