As accurate answers still not showing up, I had to take the alternative to remove index.php from http://example.com/index.php/admin

Below is my code at the top of .htaccess file

RewriteEngine on
RewriteBase /
RewriteCond %{REQUEST_URI} !^/index.php/admin/
RewriteRule ^index.php/(.*) $1 [R=301,QSA,L]

I have written below code at the bottom of .htaccess file

<Files admin>

 AuthUserFile /var/www/magento/.htpasswd
 AuthName "Private access"
 AuthType Basic
 require user dummyuser


Problem: Currently it successfully blocked the URL http://example.com/admin but not http://example.com/index.php/admin.

Also index.php is removed from http://example.com/index.php/admin but not from http://example.com/index.php/admin/ with /

I am using Magento


You should be able to do this using the combination of mod_env and the Satisfy any directive. You can use SetEnvIf to check against the Request_URI, even if it's not a physical path. You can then check if the variable is set in an Allow statement. So either you need to log in with password, or the Allow lets you in without password:

# Do the regex check against the URI here, if match, set the "require_auth" var
SetEnvIf Request_URI ^/index.php/admin require_auth=true

# Auth stuff
AuthUserFile /var/www/htpasswd
AuthName "Password Protected"
AuthType Basic

# Setup a deny/allow
Order Deny,Allow
# Deny from everyone
Deny from all
# except if either of these are satisfied
Satisfy any
# 1. a valid authenticated user
Require valid-user
# or 2. the "require_auth" var is NOT set
Allow from env=!require_auth
| improve this answer | |
  • I dnt need to block from ip,I just need to password protect – Hiranya Sarma Oct 18 '16 at 13:23
  • @Hiranya check my edited ans – Nikunj Vadariya Oct 18 '16 at 13:29
  • It's not working. – Hiranya Sarma Oct 19 '16 at 4:45

Besides adding an extra password protection through the htaccess. I recommend to change the admin key this can be done in through configuration in the system admin section or in the local.xml

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.