: IIS7.5 + Wordpress + Restrict Access to wp-login.php by client IP address I am moving from an Apache host to IIS. One of my sites in Wordpress (running Multi-site) which give me multiple blogs.

@Phylliss660

I found this can be done with URL ReWrite

Credit to: www.youtube.com/watch?feature=player_embedded&v=ut0pD2l4z5c#!
from web.config

Be sure to add the ServerVariable you choose (HTTP_X_AdminIPAllowed in my example) to allowed server variables from the URL ReWrite module in the IIS Console.

This example allows access to 192.168.1.* clients to all copies of wp-login.php

<rewrite>
<rules>
<clear />
<rule name="FlagAdminIPs" patternSyntax="ECMAScript">
<match url=".*" />
<conditions logicalGrouping="MatchAny" trackAllCaptures="false">
<add input="{REMOTE_ADDR}" pattern="^192.168.1.(1(2[8-9]|[3-9][0-9])|2([0-4][0-9]|5[0-4]))$" />
</conditions>
<serverVariables>
<set name="HTTP_X_AdminIPAllowed" value="yes" />
</serverVariables>
<action type="None" />
</rule>
<rule name="Restrict wp-login.php access" enabled="true" stopProcessing="true">
<match url=".*" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false">
<add input="{REQUEST_FILENAME}" pattern="wp-login.php" />
<add input="{HTTP_X_AdminIPAllowed}" pattern="yes" negate="true" />
</conditions>
<action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
</rule>
</rules>
</rewrite>

Vote Up Vote Down