Support

Thank you for sharing your .htaccess file and the Control Panel screenshot.

Reviewing and debugging custom-written .htaccess rules — such as the ones you’ve added under the “My Additional / Changed / Rearranged Rules” section — is outside the scope of what we can support. Once you edit the file that Admin Tools generates and add your own RewriteCond / RewriteRule / SetEnvIf blocks, that code becomes your own custom code, and we can’t guarantee, test, or debug code that we didn’t write. We’re glad to help with anything generated directly by the .htaccess Maker itself, but troubleshooting hand-written rules for correctness would fall under custom development rather than standard support.

That said, there is a built-in Admin Tools feature designed specifically to catch and block requests like /wp-login.php, /wp-admin/*, /wp-content/*, etc. without needing any manual .htaccess rules: 404Shield, part of the Web Application Firewall (Components → Admin Tools → Web Application Firewall → 404Shield). Its default block list already includes wp-admin.php, wp-admin?format=php, wp-login.php, wp-content/*, and wp-admin/*, since these paths can never legitimately exist on a Joomla site and are a reliable sign of an automated attack tool.

When you combine 404Shield with the “Auto-ban Repeat Offenders” option in the WAF configuration, an IP that keeps probing those paths gets automatically added to the Site IP Deny List after a configurable number of hits. That would let Admin Tools take care of this traffic pattern for you automatically, reducing the need to maintain and manually blacklist IPs yourself.

If 404Shield isn’t already enabled on your site, turning it on (leaving wp-login.php and the other WordPress-only paths in its default list) should handle this specific probing pattern going forward.