wp-admin Access Restriction SOP

wp-admin Access Restriction SOP
The dashboard should be reachable only by people who need it.

— Step 1: Identify your team's source IPs or VPN exit range.
— Step 2: Restrict /wp-admin/ and /wp-login.php at the server to that allowlist — but exclude admin-ajax.php, the front end needs it.
— Step 3: No static team IP? Put the dashboard behind a VPN or an auth proxy (Cloudflare Access).
— Step 4: Add HTTP basic auth as a second pre-WordPress gate on the login path.
— Step 5: Force HTTPS on every admin request via FORCE_SSL_ADMIN.
— Step 6: Log every admin-area hit to your central pipeline.
— Verify: an off-allowlist IP gets 403 at /wp-login.php.

Run this every time.