I need to allow specific IP's/IP range as authorized users to access Magento admin area and redirect to 404 page not found if an unauthorized IP try to access http://store.com/admin. Could think of following two approach

  1. Add below in .htaccess file

    RewriteCond %{REQUEST_URI} ^/(index.php/)?admin [NC] RewriteCond %{REMOTE_ADDR} !^1\.1\.1\.1 RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L]

where is my IP address

  1. Make a custom module and listen to the event that detects admin url access and check the IP if it matches. If it does not, redirect user to 404 page not found

    • Which one is the better approach to restrict admin access?
    • If .htaccess approach, then how do I add multiple IP's and IP range?
    • If custom code approach, then which event I may have to use to detect admin url access?

Note: The user should not be even see admin login page but as soon as hit admin url, redirect to 404 page not found

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.