Block wordpress bruteforce wp-login.php attack when the apache is behind a proxy and send the real IP in the X-Forwarded-For header.

gistfile1.apacheconf

 <Files wp-login.php>
    Order deny,allow
    Deny from all
    
    #Single IP  
    SetEnvIF X-Forwarded-For "x.x.x.x" AllowIP
    
    #IP Range (example for a XXX.XXX.0.0/16)
    # http://stackoverflow.com/questions/17967294/how-can-i-make-a-regular-expression-for-ip-address-with-subnetmask
    SetEnvIF X-Forwarded-For "^XXX\.XXX\.(?:[0-9]{1,2}|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.(?:[1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])$" AllowIP
    
      
    Allow from env=AllowIP
</Files>