[ad_1]
[ad_2]
So a long time customer came up to me with a request from the ITsec of his company. They want the wordpress admin panel to be only accessible from their corporate network and vpn. But whitelisting is not allowed in any case.
I know i will have to hire someone else to do it. But first i want to understand how this would even be possible. Because i can't think of an option to make this work without whitelisting at least their vpn ip or any ip.
Can someone give me any examples on how this is possible?
Thanks in advance!
Edit: I just started reading about revers proxy server. Is this a possible way to go or should i drop this approach?
Why isn’t whitelisting allowed? To my mind this is the only way to achieve blocking all access to admin – using something like a regex WAF rule on the server.
Another potential option could be to use some sort of external desktop 2FA platform (Authelia open source springs to mind) that is only accessible via the corporate network (I’ve also seen them tied to NFC/card readers). No direct experience in this though.