Hacker News Reader

Solution: add http auth to your /wp-admin directory

This will break things.

Edit: Why the downvotes? Lots of non-admin stuff lives inside wp-admin, "add http auth" is terrible advice.

https://censys.io/ipv4?q=%22wp-admin%2Fadmin-ajax.php%22

Hundreds of thousands of sites with "wp-admin/admin-ajax.php" on their index should more than prove this.

Good point. There may be some things that are needed publicly, which you could whitelist. I've seen the whole directory behind the auth on a handful of sites though. ex] tether.to/wp-admin

Reply on news.ycombinator.com