If you’re willing to do double-logins, you can prevent people from getting to the WP directory at all by using .htaccess to password protect the entire directory. You can either log into your hosting control panel and just set a password for the whole thing, or you can do it yourself.
First you have to create a file called “.htpasswd” (inside it, put in: username:encryptedpassword) and upload it to a directory on your server (preferably outside of public_html). Then create an .htaccess file, and inside it put in:
AuthUserFile /full/path/to/.htpasswd
AuthName "Please Log In"
AuthType Basic
require user dave
that “full path” is the *server* path – not the http path.
“Dave” can be any user name you choose to set. But that’s the login name you must use to log into he directory. The htpasswd “username” would be “dave” (or whatever you replaced it with” and the “encryptedpassword” would be the password.
nce you’ve done all that, upload the .htaccess file to the /wordpress folder. Now anytime anyone tries to access it, they’ll be prompted for the username and password. if they don’t provide one (or provide the wrong one) they’ll get a forbidden message. If they provide the correct one, you’ll be taken to whatever URL you were trying to get to within the directory. You *will* have to log into WordPress though – if you try to get into the admin area. That won’t log you in automatically – it’s a totally different thing.
