Skip to content
IP Location Block
Home Pricing Articles Docs Changelog Contact My Account Get Started

Back-end target settings

Choose which comments, XML-RPC, login, admin, plugin, theme, Ajax, and post requests are checked.

Updated Aug 23, 2026

Advanced mode Start with Simple mode

Back-end targets protect WordPress entry points that are not ordinary public page views. Turn on only the targets your access policy requires.

Entry points and authentication

Configure comments and XML-RPC separately, then choose the exact login actions to protect. Failed-login limits are counted per IP.

Advanced entry point and authentication controls
Login actions can be enabled individually instead of treating every authentication request the same.

Admin and assets

Advanced admin, Ajax, plugin, and theme targets
Admin pages and background requests are separate controls.

Exceptions

Use the exception editors when a known action must remain reachable. Prefer the smallest action-specific exception and verify it in Validation logs.

Advanced back-end exception editors
Exceptions are grouped by admin, plugin, and theme request source.
Group Controls Use
Entry points Comment post, comment message, XML-RPC Protects submission and remote publishing entry points.
Authentication Login form, login actions, failed attempts Applies rules to selected authentication flows.
Admin and assets Admin, Ajax/post, plugins, themes Controls dashboard and administrative requests.
Exceptions Admin, plugin, theme actions Excludes narrowly selected actions from validation.

Before protecting login or wp-admin, confirm your current location and keep the private emergency access link available.