WordPress websites commonly receive repeated and automated login attempts targeting the ModSecurity must be installed and enabled on the Apache server. GeoIP\/GeoLocation support must be available and configured for ModSecurity. Root or administrative SSH access to the server is required. Apache configuration files must be accessible for modification. A valid ModSecurity rule ID should be used to avoid conflicts with existing rules. Take a backup of the Apache\/ModSecurity configuration before making changes.<\/p>\n\n\n 1. Open the domain configuration file. By default, the location will be \/etc\/apache2\/sites-enabled\/default<\/p>\n 2. Append the code below<\/p>\n Where,<\/p>\n Secrule – ModSecurity rule<\/p>\n Request_URI – URL to which the rules apply<\/p>\n chain – It indicates that there will be continuation of the rule to the next line.<\/p>\n id – Unique Mod_security reference ID<\/p>\n log- It tells Apache to log the message<\/p>\n msg – Message should be logged in the log<\/p>\n GEO:COUNTRY_CODE – Country code<\/p>\n streq – String Equal to<\/p>\n IN – India. If we want to allow access from other countries, then mention the two-digit code of the respective country<\/p>\n 3. Check the syntax error<\/p>\n 4. Restart the Apache server.<\/p>\n Now, if any user accesses wp-login.php from India, they will see the login page. If the user accesses wp-login.php, then they will get a “406: Not acceptable “<\/strong> page.<\/p>\n\n\n Using ModSecurity to restrict access to the WordPress 1. Can I allow access to 2. What happens when a user from a blocked country accesses 3. Can I change India to another country?<\/strong>wp-login.php<\/code> page. To reduce unwanted login traffic and improve website security, ModSecurity can be configured to restrict access to the WordPress login page based on the visitor’s country. This allows website administrators to permit login access only from trusted countries while blocking requests originating from other locations. In this example, access to wp-login.php<\/code> is restricted to users from India, while requests from other countries are blocked with a 406 Not Acceptable<\/code> response.<\/p>\n\n\n\nPrerequisites<\/h2>\n\n\n\n
Implementation:<\/h4>\n
vi \/etc\/apache2\/sites-enabled\/default<\/code><\/p>\n<IfModule\u00a0mod_security2.c>\nSecRule REQUEST_URI \"wp-login.php\" \"chain,id:2018,log,msg:'Blocking %{geo.country_code}' - Suggested by PheonixSolutions.com\"\nSecRule REMOTE_ADDR \"@geoLookup\" \"chain\"\nSecRule GEO:COUNTRY_CODE \"@streq IN\"\n<\/IfModule><\/pre>\napachectl -t<\/code><\/p>\nservice apache2 restart<\/code><\/p>\nConclusion<\/h2>\n\n\n\n
wp-login.php<\/code> page based on the visitor’s country provides an additional layer of security against unwanted and automated login attempts. In this configuration, only users from India are allowed to access the login page, while requests from other countries are blocked with a 406 Not Acceptable<\/code> response. The rule can be customized to allow access from other required countries based on the website’s business and security requirements.<\/p>\n\n\n\nFAQs<\/h2>\n\n\n\n
wp-login.php<\/code> from multiple countries?<\/strong>
Yes. The ModSecurity rule can be modified to allow multiple country codes based on the website’s requirements.<\/p>\n\n\n\nwp-login.php<\/code>?<\/strong>
The request is blocked by ModSecurity, and the user receives a 406 Not Acceptable<\/code> response.<\/p>\n\n\n\n
Yes. Replace the IN<\/code> country code in the ModSecurity rule with the required two-letter country code.<\/p>\n\n\n\nRelated Articles<\/h2>\n\n\n\n