Case: Moving wp-admin Behind Allowlist Cut Login Bot Load 99%

Case: Moving wp-admin Behind Allowlist Cut Login Bot Load 99%
Login page took 6,700 bot hits/day. Owner refused a plugin-based hidden URL (too fragile).

Allowlist SOP at nginx:

— Step 1: Restrict /wp-login.php and /wp-admin/ to office + VPN CIDRs. allow 203.0.113.0/24; deny all;
— Step 2: Exempt /wp-admin/admin-ajax.php — front-end AJAX needs it public.
— Step 3: Add an HTTP basic-auth gate on the login path as a second factor for remote staff.
— Step 4: Tail the login log for 24h to catch any locked-out legit user.

Outcome: Login-page bot hits fell from 6,700/day to ~40/day (99% drop), all from allowlisted ranges. admin-ajax.php stayed functional — zero front-end regressions. One remote editor needed a CIDR added on day one.

Run this every time.