How to Restrict Folder Access by IP Address using .htaccess

Learn how to use .htaccess files to restrict access to specific directories based on IP addresses.

This technique is particularly useful when you want to limit access to sensitive areas of your website to a select few IP addresses, thereby enhancing your site’s security.

Steps to create a .htaccess file to restrict folder access to a specific IP address

1. Open a text editor (like Notepad, TextEdit).
2. Paste the following code into your text editor:

       Require all denied
       Require ip YOUR_IP_ADDRESS
       

   Replace YOUR_IP_ADDRESS with the IP address that you want to allow access.

3. Save this file as ‘.htaccess’.
4. Upload the ‘.htaccess’ file to the directory you want to restrict access to.

Please note that this will deny access to all IP addresses except the one you specified.

Remember to replace YOUR_IP_ADDRESS with the actual IP address you want to allow. For example, if you want to allow the IP address 192.168.1.1, the code would look like this:

Require all denied
Require ip 192.168.1.1

This will restrict access to the directory to only the IP address 192.168.1.1. All other IP addresses will be denied access.

How to allow access to multiple IP addresses

Add additional ‘Require ip YOUR_IP_ADDRESS’ lines to allow multiple IP addresses to access your directory.

Require all denied
Require ip IP_ADDRESS_ONE
Require ip IP_ADDRESS_TWO
Require ip IP_ADDRESS_THREE

Please be aware that IP addresses can change, so you may need to update this file if your IP address changes. If you’re trying to allow access to a dynamic IP, you might need to consider a different method of restricting access.

Allowing Access by Subnet (CIDR Notation)

To allow access to an entire subnet, use CIDR notation directly in the Require ip directive. For example, to allow all IPs in the 192.168.1.0/24 subnet:

Require all denied
Require ip 192.168.1.0/24

This grants access to all IP addresses from ‘192.168.1.0’ through ‘192.168.1.255’.

Also, please be careful when editing .htaccess files as incorrect configurations can cause issues with your website. Always make a backup before making changes.

Frequently Asked Questions

1. What is a .htaccess file?
   A .htaccess file is a configuration file used by Apache-based web servers that controls the directory that it “lives” in–as well as all the subdirectories underneath that directory.

2. What does ‘order deny,allow’ mean in .htaccess?
   ‘Order deny,allow’ is a directive that controls the order of processing ‘allow’ and ‘deny’ rules. ‘Deny’ rules are evaluated before ‘allow’ rules.

3. What does ‘deny from all’ do in .htaccess?
   ‘Deny from all’ blocks all IP addresses from accessing the directory.

4. Can I allow multiple IP addresses to access my directory?
   Yes, you can allow multiple IP addresses by adding additional ‘Require ip YOUR_IP_ADDRESS’ lines for each IP address.

5. Can I have a .htaccess file in the main directory and another in a subdirectory with different IP addresses?
   Yes, you can have a .htaccess file in the main directory and another in a subdirectory, each with different IP addresses. The .htaccess file in the subdirectory will override the one in the main directory for that specific subdirectory.

6. If I have a .htaccess file in a subdirectory (like /API), does it affect the main directory?
   No, the .htaccess file in a subdirectory only affects that subdirectory and its subdirectories, not the main directory.

7. If I have access to a subdirectory via its .htaccess file, do I automatically have access to the main directory?
   No, access to the main directory and subdirectories are controlled separately. If your IP address is allowed in the .htaccess file of a subdirectory but not in the .htaccess file of the main directory, you will not have access to the main directory.

8. How can I restrict access to my main directory and a subdirectory to different IP addresses?
   You can do this by placing a .htaccess file in each directory, each with its own set of ‘Require ip YOUR_IP_ADDRESS’ lines for the IP addresses you want to allow for that directory.

9. Can I mix ‘allow from’ directives with ‘Require ip’? No, allow from directives are from Apache 2.2, they are discontinued and cannot be mixed with Apache 2.4 ‘Require ip’ directives. We recommend converting all Apache 2.2 allow from statements to use ‘Require ip’