Protect your wp-login.php page with HTTP Digest Authentication without the need of adding web server modules or changing config files.

Jesin A

<p>This plugin adds an additional layer of protection for the <strong>wp-login.php</strong> page using <a href="http://en.wikipedia.org/wiki/Digest_access_authentication" rel="nofollow ugc">HTTP Digest Authentication</a> with the PHP <a href="http://php.net/header" rel="nofollow ugc">header()</a> function.<br />
So it doesn’t require configuring web server files like <em>.htaccess</em> or <a href="https://websistent.com/tools/htdigest-generator-tool/" rel="nofollow ugc"><em>.htdigest</em></a> and works on all web hosting environments.</p>
<p><strong>Important:</strong> If you already have a plugin which does HTTP Authentication please deactivate it before activating this plugin. Similarly if you have configured your web server to do HTTP authentication on the wp-login.php file please remove it before using this plugin.</p>
<p>If you are using FastCGI PHP this plugin may keep prompting for the credentials even if you enter the right pair, in this case use the following in your <strong><code>.htaccess</code></strong> file</p>
<pre><code><IfModule mod_setenvif.c>
SetEnvIfNoCase ^Authorization$ "(.+)" PHP_AUTH_DIGEST=$1
</IfModule>
</code></pre>
<h4>Advantages of HTTP Digest Authentication</h4>
<ul>
<li>Digest Authentication is very much safer than HTTP Basic Authentication whose credentials can be easily decoded with a <a href="http://www.base64decode.org/" rel="nofollow ugc">base64 decoder</a>.</li>
<li>From Wikipedia on <a href="http://en.wikipedia.org/wiki/Basic_access_authentication" rel="nofollow ugc">HTTP Basic Authentication</a>:</li>
</ul>
<blockquote>
<p><em>The BA (Basic Authentication) mechanism provides no confidentiality protection for the transmitted credentials. They are merely encoded with BASE64 in transit, but not encrypted or hashed in any way.</em></p>
</blockquote>
<ul>
<li>Digest Authentication on the other hand uses <a href="https://websistent.com/tools/md5-encryption-tool/" rel="nofollow ugc">MD5</a> on the credentials making it “one way” </li>
<li>Uses server and client <a href="http://en.wikipedia.org/wiki/Cryptographic_nonce" rel="nofollow ugc">nonce</a>s to prevent replay attacks</li>
</ul>
<h4>Features of the HTTP Digest Auth plugin</h4>
<ul>
<li>Works using PHP header() function and doesn’t require modification of service config files (like .htaccess, nginx.conf etc)</li>
<li>Supports HTTP credentials for each WordPress user</li>
<li>Clears the HTTP Digest credentials when the user logs out of WordPress (more on this in the FAQ)</li>
<li>Verifies if both the HTTP and WordPress credentials are of the same user (this is the default behavior and can be changed)</li>
<li>Works on all major Web Servers (Tested on Apache, Nginx and Lighttpd)</li>
</ul>
<h4>Plugin Behavior</h4>
<ul>
<li>When this plugin is activated for the first time all WordPress users will have the following Digest credentials<br />
Username: <WordPress username><br />
Password: password<br />
This can be changed from <strong>Users > Your Profile</strong>.</li>
<li>After activating this plugin for the first time you’ll be prompted for HTTP credentials when you logout</li>
<li>Similarly if you change your HTTP username or password you’ll be prompted for this when you logout</li>
</ul>
<h4>Available languages</h4>
<ul>
<li>English</li>
<li>Serbo-Croatian by <a href="http://www.webhostinghub.com/" rel="nofollow ugc">Borisa Djuraskovic</a></li>
</ul>
<p>The <a href="https://websistent.com/wordpress-plugins/http-digest-authentication/" rel="nofollow ugc">HTTP Digest Authentication Plugin</a> official homepage.</p>


Alternatives to HTTP Digest Authentication

Top alternatives