Skip to main content
If your child site is protected by HTTP Basic Authentication (commonly added via .htaccess), the Jump to WP Admin feature in your MainWP Dashboard will not work for that site.

​
What You’ll Learn

  • Why HTTP Basic Auth blocks Jump to WP Admin
  • Alternative ways to access protected child sites
  • How to whitelist your Dashboard IP
  • Security alternatives that work with MainWP

​
Prerequisites

  • MainWP Dashboard with HTTP Basic Auth-protected child sites
  • Access to modify .htaccess (for IP whitelisting option)
  • Knowledge of your Dashboard server’s IP address (for IP whitelisting)

​
Why This Limitation Exists

HTTP Basic Authentication operates at the server level, before WordPress even loads. When you click Jump to WP Admin, your browser attempts to access the child site’s wp-admin URL directly. The server intercepts this request and demands credentials before allowing access. Browsers and HTML forms don’t support passing HTTP Basic Auth credentials as part of a link or form submission. This is a security feature—browsers intentionally prevent websites from automatically authenticating to other sites on your behalf. MainWP’s auto-login system works by submitting WordPress credentials through a secure form. This happens at the application level, after the server has already verified access. HTTP Basic Auth blocks the request before MainWP’s authentication can occur.

​
Alternative Access Methods

​
Option 1: Use Your Browser’s Password Manager

Most browsers can save HTTP Basic Auth credentials.
1

Visit the site

Navigate to the child site’s wp-admin URL directly in your browser.
2

Enter credentials

Enter the HTTP Basic Auth credentials when prompted.
3

Save credentials

Check “Remember” or allow your browser to save the credentials.
4

Access normally

Future visits (including Jump to WP Admin) will auto-fill the HTTP Basic Auth prompt.
This works well if you use the same browser consistently. The browser remembers credentials per-domain and fills them automatically.

​
Option 2: Access wp-admin Directly

Instead of using Jump to WP Admin:
1

Open new tab

Open a new browser tab.
2

Navigate to wp-admin

Go to https://yourchildsite.com/wp-admin/
3

Authenticate

Enter HTTP Basic Auth credentials if prompted.
4

Log in

Log in to WordPress normally.
Bookmark the wp-admin URL for quick access. Once authenticated with HTTP Basic Auth, your browser session typically remains valid until you close the browser.

​
Option 3: Whitelist the MainWP Dashboard IP

If your HTTP Basic Auth is configured via .htaccess, you can allow your Dashboard server to bypass authentication: 
# Existing HTTP Basic Auth configuration
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /path/to/.htpasswd
Require valid-user

# Allow MainWP Dashboard IP to bypass
Satisfy Any
Allow from YOUR.DASHBOARD.IP.ADDRESS
Replace YOUR.DASHBOARD.IP.ADDRESS with your MainWP Dashboard server’s IP. Find this at MainWP > Info > Server.
Only use IP whitelisting if your Dashboard has a static IP address. Dynamic IPs would require frequent .htaccess updates.

​
Security Alternatives to HTTP Basic Auth

Consider these alternatives if the Jump to WP Admin limitation affects your workflow:

​
Application-Level Security

MethodDescription
Security pluginsLimit login attempts, add CAPTCHA
Two-factor authenticationRequire 2FA for admin login
IP restrictionsRestrict wp-admin access by IP at WordPress level

​
Server-Level Alternatives

MethodDescription
Firewall rulesBlock access based on IP at firewall level
VPN requirementsRequire VPN connection to access site
Client certificatesSSL client certificate authentication
These alternatives protect your site while allowing MainWP’s Jump to WP Admin feature to function normally.

​
Security Note

HTTP Basic Auth remains a valid security layer despite this limitation. The credential prompt adds protection against unauthorized access, especially for staging sites or development environments. If your security requirements include HTTP Basic Auth, use one of the alternative access methods above rather than removing the protection.

​
Self-Check Checklist

  • Identified which child sites use HTTP Basic Auth
  • Chose an alternative access method
  • Browser password manager configured (if using Option 1)
  • Dashboard IP whitelisted (if using Option 3)
  • Successfully accessed HTTP Basic Auth-protected sites