我有一个httpd.conf的“规则”来popup一个窗口，如果有人试图访问wordpress安装的任何域的wp-admin部分。 有了这个规则，我阻止了访问wp-admin文件夹的引导，并阻止暴力攻击。
# BEGIN BLOCK-WP-ADMIN-ATTACK <Files wp-login.php> AuthType basic AuthName "EN: Human Check - U: human P: letmein" AuthBasicProvider file AuthUserFile /home/wp-admin-attack-htpasswd-file Require valid-user ErrorDocument 401 "<center><h1>Warning!</h1>You failed to authenticate.<p><br />Extra security has been temporarily enabled due to an ongoing attack against WordPress logins on this server.<br /> <b>If you are a real user, please refresh the page and enter the username and password that are provided on the pop-up.</b><p>If you are still having troubles, please contact your hosting provider.</center>" </Files> # END BLOCK-WP-ADMIN-ATTACK #
这个规则是应该的，但现在我想“允许”一个域名，所以这个规则不适用于这个域名。
我想你应该可以使用SetEnvIf来做到这一点。 这是未经testing，但可能会指出你在正确的方向：
# set env ALLOWED if hostname is either example.com or # the client ip is 192.168.0.1 SetEnvIf Host example\.com ALLOWED SetEnvIf Remote_Addr 192.168.0.1 ALLOWED # if ALLOWED is not set display the password prompt <IfDefine !ALLOWED> <Files wp-login.php> AuthType basic AuthName "EN: Human Check - U: human P: letmein" AuthBasicProvider file AuthUserFile /home/wp-admin-attack-htpasswd-file Require valid-user ErrorDocument 401 "<center><h1>Warning!</h1>You failed to authenticate.<p><br />Extra security has been temporarily enabled due to an ongoing attack against WordPress logins on this server.<br /> <b>If you are a real user, please refresh the page and enter the username and password that are provided on the pop-up.</b><p>If you are still having troubles, please contact your hosting provider.</center>" </Files> </IfDefine>
我会坚持satisfy any 。 这是一个工作certificate的概念：
<Files wp-login.php> Satisfy Any Order deny,allow Deny from all Allow from example.org AuthType basic AuthName "EN: Human Check - U: human P: letmein" AuthBasicProvider file AuthUserFile /home/wp-admin-attack-htpasswd-file Require valid-user #ErrorDocument here </Files>
你可以使用satisfy any指令
<VirtualHost *:80> # [ Server Domain ] ServerName the.domaine.allowed # [ Server Root ] DocumentRoot /var/www/ # [ Pass Through Auth] <Files wp-login.php> satisfy any </Files> <VirtualHost>