Does it actually help keep a site more secure to deny all access to WP admin and make changes directly on the FTP only?

Our WP has been hacked twice now. It seems that everyone has a different idea on how to keep WP secure and as a part of the security services we received one of the consultants recommended blocking all admin access.

Fast forward a few months and it's hard to manage guest content because we end of having to do it (guest writers don't know how to use the FTP, also we worry about providing access).

So we have 3 options: - Keep blocked to all - Allow only certain IPs - Open access to all

I'm grateful for any guidance.

  • 2
    Wouldn't it be helpful to try to identify HOW it was hacked first?
    – user36976
    Mar 24, 2014 at 12:38
  • Yes, definitely. According to the consultant, there were vulnerabilities because of old and not updated plug ins, which allowed access to our server. I should have clarified that we have about 12 websites on our server and 2 were compromised.
    – Rae
    Mar 26, 2014 at 9:22
  • WHICH plug-in was it?. Check the link in my answer below I think that was your weakest point
    – AK_
    Jun 2, 2014 at 22:58

2 Answers 2


As Nick stated, you should really look through your logs and determine how your site was compromised to learn how to best mitigate it moving forward.

I don't believe blocking access to the admin will serve much good, except to inconvenience whoever has the job of maintaining it. I would hope the password was not guessed, and installing a plugin like All In One WP Security will mitigate brute force attacks.

If I had to hedge a bet I would guess (without any further details to what you've listed above) that either a vulnerability with your website was exploited (ie Timthumb vulnerability) or you have a security hole on the server that hosts the machine.

If you do limit admin access to local connections only you still may not mitigate the attack. Ask your security consultant to find the cause of the breach, and then work towards patching.

  • Thanks for your answer! The consultant says that the vulnerability was from using old plug ins and not updating WP. One of the main issues is that it's a fairly complex site and every time we update plugins some elements don't work right. I will check that the timthumb has been deleted and maybe invest some time or money in updating the site. I'll also add a security plugin if the consultant hasn't already. And also maybe consider hosting it on a different server if we can't secure it as to prevent it from inviting problems into our server's other sites. And reopen admin access, 10x :)
    – Rae
    Mar 26, 2014 at 9:34

If you use a plug-in called All in One SEO it probably was the weakest point. Here is an article about its latest security flaw.

General rules:

  1. Use a safe browser (With XSS protection)
  2. Protect your /wp-admin (guide)
  3. Keep up-to-date.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .