Currently, I prevented accessing my wp-admin by htaccess as well as used functions.php to create a function to prevent accessing admin panel if the user is Admin.

If someone knows the username and password of the Admin account, is it possible to change my website appearance as well as deleting posts/comments, etc.?

If possible, how could they?

  • 1
    It's not clear what you mean by "prevent accessing admin panel if user is Admin" - are you blocking all admin level users, a specific admin user, or something else? It may also come down to whether you have enabled any plugins which allow appearance changes, or expose details such as FTP credentials.
    – Matthew
    Commented Oct 18, 2018 at 8:39
  • Hi @Matthew. I block all admin level users
    – Hai Tien
    Commented Oct 18, 2018 at 8:47
  • You would need to post specific .htaccess rules and php function you've created in this matter in order for anyone to be able to answer your question.
    – Eda190
    Commented Oct 18, 2018 at 10:02

1 Answer 1


As every lawyers first sentence: It depends. So without exactly knowing what you did, let's do a little "risk-assessment".

There are multiple ways of compromising wordpress based websites:

  • knowing the admin-credentials
  • finding a vulnerability in wordpress
  • discovering a vulnerability in one of the used plugins
  • finding a vulnerability in the webserver or it's configuration

Where vulnerability as in: Software-vulnerability, misconfiguration and so on. Also we have to further split all those possibilities into two options:

  • going from zero to admin
  • escalating from user to admin

So let's see what you have accomplished: If the admin-access really is blocked and properly blocked, knowing the admin-credentials is not a direct threat to the page anymore (it can still be if you reuse credentials from somewhere else or if your .htaccess or function does not block all the resources properly).

There is still multiple options to go for when targeting your site. I suggest you have a look at this page. The statistics are a little too agressive in my opinion but you will get a feeling for the problems you might face when protecting your site.

“73.2% of the most popular WordPress installations are vulnerable to vulnerabilities which can be detected using free automated tools.” – WpWhiteSecurity.com

This seems quite a lot to me but it's not unimaginable. That is not exactly what you are asking but it's some information to consider when thinking about how to lock down your site. There also is a quote about credentials but its really out of context so read the links carefully before really making your opinion.

So without knowing your exact target or your exact approach: Locking down your admin account is a nice approach (if it works properly) but credentials are not the only way to transform wordpress installations into something else. And probably (careful; assumption) they are not really needed in most of the cases. If someone manages to find some SQLi or RCE in your WP installation (not unlikely as shown before) or one of the plugins (even more likely) your security measure might not really catch.

  • Thank for your great answer. I do not use any plugin in my website. phpmyadmin is protected by two-authentication. I think maybe I understand my site is secure in the definition.
    – Hai Tien
    Commented Oct 18, 2018 at 11:16
  • I think not using any plugins and additional protection minimizes the attack surface. Also, keeping your setup updated on a regular basis is important. If you do so, your attack surface will be significantly lower compared to quite a lot of other wordpress sites.
    – Ben
    Commented Oct 18, 2018 at 11:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .