“order deny,allow” only works when after rewrite rules?

1 Views

I have a wordpress site I wanted to block access to temporarily and added order deny,allow to the .htaccess file: 

RewriteEngine off
order deny,allow
deny from all
allow from [my ip]

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

However, it didn’t work.

Read More

I tried moving it to below the rewrite rules: 

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

RewriteEngine off
order deny,allow
deny from all
allow from [my ip]

And is started working.

Why doesn’t it work in the first example?

Post Views: 1

Related posts

1 comment

  1. In WordPress htaccess, this comments:

    # BEGIN WordPress
# END WordPress

    Are used by WordPress to dynamically add additional rules. If you look into wp-admin/includes/misc.php, there is a function named save_mod_rewrite_rules which handle the writing of your htaccess. Inside this function the rules are get from the mod_rewrite_rules method of WP_Rewrite, a class located in wp-includes/rewrite.php. If you look into that method you will see that line on the end:

    $rules = apply_filters( 'mod_rewrite_rules', $rules );

    It means that a filter is applied on the rules, so whatever plugin / theme can override this rules to add his own, and so add access policy. Maybe WP core add his own deny/allow rules. So maybe this is your problem here.

    An alternative solution to allow, deny rules is to use a RewriteCond to throw a 403 for all IP other than your (put this on the top of your htaccess):

    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REMOTE_ADDR} !^[your IP]$
    RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

Comments are closed.