Amin, I'm curious why you'd Disable Security on Admin? I have it set to High in addition to using a Firewall Rule that only allows my IP to access /wp-login.phpYes, this is what I use:
View attachment 146648
I added the trailing slash for the attachments rule to make it compatible with WMTech Attachment Manager.