2

I have tried a lot of different methods of restricting the access via .htaccess and I can not get it to work. I have tried both methods on production and on fresh magento installation on new cPanel. Any idea why this doesn't work?

Method 1:

 Order deny,allow
 Deny from all
 Allow from 1.1.1.1

Method 2:

 RewriteCond %{REQUEST_URI} ^/admin/ [NC]
 RewriteCond %{REMOTE_ADDR} !^1.1.1.1
 RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L]
Improve this question
1
  • 1
    What the actual placement of code in .htaccess post .htaccess code here
    – Prashant Valanda
    Commented Mar 10, 2016 at 13:14

4 Answers 4

Reset to default
2

Try below code in your .htaccess file:

If your apache version is 2.4 try:

 # ALLOW USER BY IP
<Limit GET POST>
    Require all denied
    Require ip 127.0.0.1
</Limit>

And if your apache version is 2.2 try:

 # ALLOW USER BY IP
<Limit GET POST>
     order deny,allow
     deny from all
     allow from 127.0.0.1
</Limit>

To restrict admin, try below .htaccess rule:

RewriteCond %{REMOTE_ADDR} !^127.0.0.1
RewriteCond %{REQUEST_URI} admin [NC]
RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L]

PS: Change 127.0.0.1 with your allowed IP address and admin with your shop admin frontend name.

Hope this work for you.

Improve this answer
4
  • The second option works like a charm! - not sure why the default restriction did work previously - perhaps some server side mod update.How do I go about blocking the admin panel using this?
    – pasujemito
    Commented Mar 10, 2016 at 13:25
  • Hi, check this answer to restrict your admin access for specific IP.
    – Jayesh Patel
    Commented Mar 10, 2016 at 13:54
  • I did try this before - see my post - none of the solutions work for restricting admin access.
    – pasujemito
    Commented Mar 10, 2016 at 13:58
  • @damek132, I update my answer please try to add .htaccess rule mentioned in answer.
    – Jayesh Patel
    Commented Mar 11, 2016 at 5:29
2

It's all about placement within /.htaccess : If you installed the sample .htaccess,

look for:

############################################
## you can put here your magento root folder
## path relative to web root

    #RewriteBase /magento/

+add this immediately below it (changing/removing/adding IP(s))+

############################################
## Restrict /admin /index.php/admin
## (IF THIS):
RewriteCond %{REQUEST_URI} ^(/admin|/index.php/admin).*$ [NC]
# (AND !NOT THIS/THESE) our allowed admin ip(s)
RewriteCond %{REMOTE_ADDR} !^254\.254\.254\.254
RewriteCond %{REMOTE_ADDR} !^10\.10\.10\.10
# (DO THIS)
RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L]

This example will allow two IP addresses access while redirecting to homepage on all others.

Tested on Apache 2.4.7 with unmodified Magento Community v1.9.2.4 - works fine.

Improve this answer
0

Try this,

RewriteCond %{REMOTE_ADDR} !^1.1.1.1

RewriteCond %{REQUEST_URI} admin [NC]

RewriteRule ^(.*)$ / [F,L]
Improve this answer
1
  • I have tried this as well with no luck.
    – pasujemito
    Commented Mar 10, 2016 at 12:45
0

Use below In fresh magento .htaccess file have two below line 

Order allow,deny
Allow from all

comment it

#Order allow,deny
 #Allow from all

add after

order deny,allow
Deny from all
Allow from 1.1.1.1
Improve this answer
1
  • All possible solutions I think I have checked. Need some resolution perhaps regarding the correct apache mod setting. I am using Apache/2.2.31
    – pasujemito
    Commented Mar 10, 2016 at 12:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.