Htaccess passive protection for WordPress WP Admin

RewriteEngine On

# Is this a request for wp-login?
RewriteCond %{REQUEST_URI} ^/wp\-login\..*

# Check for the secret word
RewriteCond %{QUERY_STRING} .*tennis=.*

# Set a cookie, so that all future requests will be auto-authenticated
RewriteRule ^.* /wp-admin/ [cookie=tennis:true:DOMAIN.com:3600:/,R,L]

# Is this a request to the admin?
# comment out this line and you will be able to reach wp-login.php, but not anything in /wp-admin/ until you authenticate
RewriteCond %{REQUEST_URI} ^/wp\-login\..* [OR]
RewriteCond %{REQUEST_URI} ^/wp\-admin/.*
RewriteCond %{HTTP_COOKIE} !\btennis\b

# Unathenticated, redirect to homepage with a disallowed indicator
RewriteRule ^.* /?disallowed=true [R,L]