/wp-admin

If you do not allow visitors to register, login and post comments on your website then you can use BasicAuth Directory Password protection. You would set that up in your web host control panel and .htaccess code will be automatically added to your wp-admin .htaccess file when you do that.

You would then need to copy that .htaccess code that your host creates in the wp-admin .htaccess file to this BPS Custom Code text box: CUSTOM CODE WPADMIN TOP: Add wp-admin password protection, IP whitelist allow access & miscellaneous custom code here, click the Save wp-admin Custom Code button and activate wp-admin BulletProof Mode again.

Then I assume what you are saying is you have other designated people who log into the site to create Posts and you do NOT allow random visitors to your website to post comments. If this is true and you add BasicAuth Directory Password Protection then you will need to provide the Directory Password Protection login credentials to all the people you DO allow to login to your site.

Then you cannot use BasicAuth Directory Password Protection.

Anyone who logs into your website needs to be able to access the /wp-admin folder in order to be able to login to your website.

Create a test Subscriber user account on your website by registering to your site and login to the site and you will see why you cannot use Directory Password Protection.

The problem with that is the WordPress admin-ajax.php file is located in the /wp-admin folder. 😉 Personally I think it is a silly and unnecessary thing to add Directory Password Protection to the /wp-admin folder. The logic is this: The /wp-admin folder already has authentication protection so adding a second authentication for the /wp-admin folder does not make it any more secure = silly.

We have tested Better WP Security before and it works with BPS, but there are some known common issues and problems with that plugin so you should check that plugin’s support forum for solutions to those problems. We only handle BPS solutions. 😉