title: Access control not working in .htaccess
body: <p>I would like to grant access for specific IP addresses to specific pages on my WordPress site</p>
  
  <p>I have the following .htaccess setup:</p>
  
  <pre><code>RewriteOptions inherit
  # BEGIN WP Rocket v2.9.11
  # Use UTF-8 encoding for anything served text/plain or text/html
  AddDefaultCharset UTF-8
  # Force UTF-8 for a number of file formats
  &lt;IfModule mod_mime.c&gt;
  AddCharset UTF-8 .atom .css .js .json .rss .vtt .xml
  &lt;/IfModule&gt;
  # FileETag None is not enough for every server.
  &lt;IfModule mod_headers.c&gt;
  Header unset ETag
  &lt;/IfModule&gt;
  # Since we’re sending far-future expires, we don’t need ETags for static content.
  # developer.yahoo.com/performance/rules.html#etags
  FileETag None
  &lt;IfModule mod_alias.c&gt;
  &lt;FilesMatch "\.(html|htm|rtf|rtx|txt|xsd|xsl|xml)$"&gt;
  &lt;IfModule mod_headers.c&gt;
  Header set X-Powered-By "WP Rocket/2.9.11"
  Header unset Pragma
  Header append Cache-Control "public"
  Header unset Last-Modified
  &lt;/IfModule&gt;
  &lt;/FilesMatch&gt;
  &lt;FilesMatch "\.(css|htc|js|asf|asx|wax|wmv|wmx|avi|bmp|class|divx|doc|docx|eot|exe|gif|gz|gzip|ico|jpg|jpeg|jpe|json|mdb|mid|midi|mov|qt|mp3|m4a|mp4|m4v|mpeg|mpg|mpe|mpp|otf|odb|odc|odf|odg|odp|ods|odt|ogg|pdf|png|pot|pps|ppt|pptx|ra|ram|svg|svgz|swf|tar|tif|tiff|ttf|ttc|wav|wma|wri|xla|xls|xlsx|xlt|xlw|zip)$"&gt;
  &lt;IfModule mod_headers.c&gt;
  Header unset Pragma
  Header append Cache-Control "public"
  &lt;/IfModule&gt;
  &lt;/FilesMatch&gt;
  &lt;/IfModule&gt;
  # Expires headers (for better cache control)
  &lt;IfModule mod_expires.c&gt;
  ExpiresActive on
  # Perhaps better to whitelist expires rules? Perhaps.
  ExpiresDefault                          "access plus 1 month"
  # cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5)
  ExpiresByType text/cache-manifest       "access plus 0 seconds"
  # Your document html
  ExpiresByType text/html                 "access plus 0 seconds"
  # Data
  ExpiresByType text/xml                  "access plus 0 seconds"
  ExpiresByType application/xml           "access plus 0 seconds"
  ExpiresByType application/json          "access plus 0 seconds"
  # Feed
  ExpiresByType application/rss+xml       "access plus 1 hour"
  ExpiresByType application/atom+xml      "access plus 1 hour"
  # Favicon (cannot be renamed)
  ExpiresByType image/x-icon              "access plus 1 week"
  # Media: images, video, audio
  ExpiresByType image/gif                 "access plus 1 month"
  ExpiresByType image/png                 "access plus 1 month"
  ExpiresByType image/jpeg                "access plus 1 month"
  ExpiresByType video/ogg                 "access plus 1 month"
  ExpiresByType audio/ogg                 "access plus 1 month"
  ExpiresByType video/mp4                 "access plus 1 month"
  ExpiresByType video/webm                "access plus 1 month"
  # HTC files  (css3pie)
  ExpiresByType text/x-component          "access plus 1 month"
  # Webfonts
  ExpiresByType application/x-font-ttf    "access plus 1 month"
  ExpiresByType font/opentype             "access plus 1 month"
  ExpiresByType application/x-font-woff   "access plus 1 month"
  ExpiresByType application/x-font-woff2  "access plus 1 month"
  ExpiresByType image/svg+xml             "access plus 1 month"
  ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
  # CSS and JavaScript
  ExpiresByType text/css                  "access plus 1 year"
  ExpiresByType application/javascript    "access plus 1 year"
  &lt;/IfModule&gt;
  # Gzip compression
  &lt;IfModule mod_deflate.c&gt;
  # Active compression
  SetOutputFilter DEFLATE
  # Force deflate for mangled headers
  &lt;IfModule mod_setenvif.c&gt;
  &lt;IfModule mod_headers.c&gt;
  SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding
  RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
  # Don’t compress images and other uncompressible content
  SetEnvIfNoCase Request_URI \
  \.(?:gif|jpe?g|png|rar|zip|exe|flv|mov|wma|mp3|avi|swf|mp?g|mp4|webm|webp)$ no-gzip dont-vary
  &lt;/IfModule&gt;
  &lt;/IfModule&gt;
  # Compress all output labeled with one of the following MIME-types
  &lt;IfModule mod_filter.c&gt;
  AddOutputFilterByType DEFLATE application/atom+xml \
                                    application/javascript \
                                    application/json \
                                    application/rss+xml \
                                    application/vnd.ms-fontobject \
                                    application/x-font-ttf \
                                    application/xhtml+xml \
                                    application/xml \
                                    font/opentype \
                                    image/svg+xml \
                                    image/x-icon \
                                    text/css \
                                    text/html \
                                    text/plain \
                                    text/x-component \
                                    text/xml
  &lt;/IfModule&gt;
  &lt;IfModule mod_headers.c&gt;
  Header append Vary: Accept-Encoding
  &lt;/IfModule&gt;
  &lt;/IfModule&gt;
  # END WP Rocket
  RewriteEngine On
  RewriteBase /
  RewriteCond %{QUERY_STRING} ^orderby=(.*)$
  RewriteRule ^/?$ %1.html? [R=301,L]
  RewriteCond %{REQUEST_URI} !^/[0-9]+\..+\.cpaneldcv$
  RewriteCond %{REQUEST_URI} !^/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
  RewriteRule ^index\.php$ - [L]
  # add a trailing slash to /wp-admin
  RewriteCond %{REQUEST_URI} !^/[0-9]+\..+\.cpaneldcv$
  RewriteCond %{REQUEST_URI} !^/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
  RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]
  RewriteCond %{REQUEST_FILENAME} -f [OR]
  RewriteCond %{REQUEST_FILENAME} -d
  RewriteCond %{REQUEST_URI} !^/[0-9]+\..+\.cpaneldcv$
  RewriteCond %{REQUEST_URI} !^/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
  RewriteRule ^ - [L]
  RewriteCond %{REQUEST_URI} !^/[0-9]+\..+\.cpaneldcv$
  RewriteCond %{REQUEST_URI} !^/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
  RewriteRule ^([_0-9a-zA-Z-]+/)?(wp-(content|admin|includes).*) $2 [L]
  RewriteCond %{REQUEST_URI} !^/[0-9]+\..+\.cpaneldcv$
  RewriteCond %{REQUEST_URI} !^/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
  RewriteRule ^([_0-9a-zA-Z-]+/)?(.*\.php)$ $2 [L]
  RewriteCond %{REQUEST_URI} !^/[0-9]+\..+\.cpaneldcv$
  RewriteCond %{REQUEST_URI} !^/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
  RewriteRule . index.php [L]
  
  
  # Wordfence WAF
  &lt;Files ".user.ini"&gt;
  &lt;IfModule mod_authz_core.c&gt;
      Require all denied
  &lt;/IfModule&gt;
  &lt;IfModule !mod_authz_core.c&gt;
      Order deny,allow
      Deny from all
  &lt;/IfModule&gt;
  &lt;/Files&gt;
  
  # END Wordfence WAF
  
  &lt;IfModule mod_rewrite.c&gt;
  RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
  RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
  RewriteCond %{REMOTE_ADDR} !^123.123.123.123$
  RewriteCond %{REMOTE_ADDR} !^123.123.123.123$
  RewriteCond %{REMOTE_ADDR} !^123.123.123.123$
  RewriteRule ^(.*)$ - [R=403,L]
  &lt;/IfModule&gt;
  </code></pre>
  
  <p>I used the snippet from this post <a href="https://themeisle.com/blog/whitelist-ip-addresses-in-wordpress/" rel="nofollow noreferrer">https://themeisle.com/blog/whitelist-ip-addresses-in-wordpress/</a> and replaced the default 123.123.123.123 with the IP addresses I would like to grant access</p>
  
  <p>This doesn't seem to work for me but I'm assuming there is something in the .htaccess interfering with the snippet?</p>