When malicious bots and automated scripts attempt to compromise your website, their primary target is always your WordPress login area. Even if you have a strong WordPress password and they fail to gain access, this constant bombardment forces your server to execute heavy PHP processes hundreds of times a minute. This "brute-force" activity can quickly max out your hosting resources, causing severe CPU spikes and slowing down your website for your actual visitors.
By adding a server-level password to your wp-admin directory directly within your Sternhost control panel, you create an impenetrable wall. Bots are instantly rejected by the server before WordPress even has a chance to load, completely neutralizing the threat and preserving your server's performance.
Step 1: Accessing the Directory Privacy Tool
You can lock down your admin dashboard directly from your hosting account without needing to install any heavy security plugins on WordPress itself.
-
Log in to your Sternhost cPanel dashboard.
-
Scroll down to the Files section.
-
Click on the Directory Privacy icon.
-
Click on your
public_htmlfolder to open it and view your website's core directories.
Step 2: Creating the Security Rule
Once you have located your core files, you will apply the lock specifically to the folder that controls your backend access.
-
Find the folder named
wp-adminand click directly on its name. -
Check the box labeled "Password protect this directory".
-
In the "Enter a name for the protected directory" field, type something simple like "Secure Area" and click Save.
-
Click "Go Back" to return to the previous screen.
-
Scroll down to the "Create User" section. Create a new username (do not use your WordPress username) and generate a strong password.
-
Click the Save button. Now, whenever you try to access your WordPress dashboard, your browser will prompt you for these server credentials first.
Why Directory Privacy is the Ultimate Defense
-
Zero PHP Execution: Because the block happens at the server level (Apache/LiteSpeed), the bots are denied access before they can trigger any of your website's database queries or PHP scripts.
-
Eliminates 508 Resource Errors: By stopping high-volume brute-force attacks in their tracks, your server's CPU and RAM remain free to serve your actual customers, preventing your site from going offline during an attack.
-
A Foolproof Second Layer: Even if a hacker somehow discovers your actual WordPress login details, they still cannot access the login page without passing this initial, hidden server checkpoint.
