2

I have tried a lot of different methods of restricting the access via .htaccess and I can not get it to work. I have tried both methods on production and on fresh magento installation on new cPanel. Any idea why this doesn't work?

Method 1:

 Order deny,allow
 Deny from all
 Allow from 1.1.1.1

Method 2:

 RewriteCond %{REQUEST_URI} ^/admin/ [NC]
 RewriteCond %{REMOTE_ADDR} !^1.1.1.1
 RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L]
  • 1
    What the actual placement of code in .htaccess post .htaccess code here – Prashant Valanda Mar 10 '16 at 13:14
2

Try below code in your .htaccess file:

If your apache version is 2.4 try:

 # ALLOW USER BY IP
<Limit GET POST>
    Require all denied
    Require ip 127.0.0.1
</Limit>

And if your apache version is 2.2 try:

 # ALLOW USER BY IP
<Limit GET POST>
     order deny,allow
     deny from all
     allow from 127.0.0.1
</Limit>

To restrict admin, try below .htaccess rule:

RewriteCond %{REMOTE_ADDR} !^127.0.0.1
RewriteCond %{REQUEST_URI} admin [NC]
RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L]

PS: Change 127.0.0.1 with your allowed IP address and admin with your shop admin frontend name.

Hope this work for you.

| improve this answer | |
  • The second option works like a charm! - not sure why the default restriction did work previously - perhaps some server side mod update.How do I go about blocking the admin panel using this? – damek132 Mar 10 '16 at 13:25
  • Hi, check this answer to restrict your admin access for specific IP. – Jayesh Patel Mar 10 '16 at 13:54
  • I did try this before - see my post - none of the solutions work for restricting admin access. – damek132 Mar 10 '16 at 13:58
  • @damek132, I update my answer please try to add .htaccess rule mentioned in answer. – Jayesh Patel Mar 11 '16 at 5:29
2

It's all about placement within /.htaccess : If you installed the sample .htaccess,

look for:

############################################
## you can put here your magento root folder
## path relative to web root

    #RewriteBase /magento/

+add this immediately below it (changing/removing/adding IP(s))+

############################################
## Restrict /admin /index.php/admin
## (IF THIS):
RewriteCond %{REQUEST_URI} ^(/admin|/index.php/admin).*$ [NC]
# (AND !NOT THIS/THESE) our allowed admin ip(s)
RewriteCond %{REMOTE_ADDR} !^254\.254\.254\.254
RewriteCond %{REMOTE_ADDR} !^10\.10\.10\.10
# (DO THIS)
RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L]

This example will allow two IP addresses access while redirecting to homepage on all others.

Tested on Apache 2.4.7 with unmodified Magento Community v1.9.2.4 - works fine.

| improve this answer | |
0

Try this,

RewriteCond %{REMOTE_ADDR} !^1.1.1.1

RewriteCond %{REQUEST_URI} admin [NC]

RewriteRule ^(.*)$ / [F,L]
| improve this answer | |
  • I have tried this as well with no luck. – damek132 Mar 10 '16 at 12:45
0

Use below In fresh magento .htaccess file have two below line

Order allow,deny
Allow from all

comment it

#Order allow,deny
 #Allow from all

add after

order deny,allow
Deny from all
Allow from 1.1.1.1
| improve this answer | |
  • All possible solutions I think I have checked. Need some resolution perhaps regarding the correct apache mod setting. I am using Apache/2.2.31 – damek132 Mar 10 '16 at 12:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.