What is the best way to restrict the access to the admin area by IP in Magento? Bear in mind that admin can work either from /admin or index.php/admin


You can place the following codes into your .htaccess file:-

RewriteCond %{REQUEST_URI} ^/(index.php/)?admin/ [NC]
RewriteCond %{REMOTE_ADDR} !^1\.1\.1\.1
RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L]

Where is your IP address.

* For the last line, make sure that there's no spacing between http:// and %{HTTP_HOST}/. StackExchange doesn't allow the code http://% to be posted so I have to add a spacing in between.

  • 1
    This code redirect from admin pages with slash after admin (admin/) and with something after the slash (admin/abc). But admin page is still loaded on "myeshop.com/admin". Is better to use rule without last slash (RewriteCond %{REQUEST_URI} ^/(index.php/)?admin [NC]) to prevent page loading – Martin Mar 21 '17 at 10:01

In case anyone uses Nginx:

location ~* ^/(index\.php/bcknd|bcknd) {

    try_files $uri $uri/ /index.php?$args;
    location ~* \.php$ { try_files /dummy @proxy; }
    deny all;

Multiples are handled by adding another match line

RewriteCond %{REQUEST_URI} ^/(index.php/)?admin(.*) [NC] 
RewriteCond %{REMOTE_ADDR} !^10\.1\.1\.10
RewriteCond %{REMOTE_ADDR} !^10\.2\.1\.10
RewriteRule .* - [F,L]

Basically it translates to if this url regex, and not these addresses, then 403, you're out of here.

  • Just reading the documentation: If you specify F then L is implied. httpd.apache.org/docs/2.4/rewrite/flags.html. "When using [F], an [L] is implied - that is, the response is returned immediately, and no further rules are evaluated." – johnsnails Feb 22 '18 at 11:41

You can also set up "allow from" rules in the httpd config for the virtual host files. I would also change the admin URL for additional security (ok kind of redundant with the "allow from"s but belt and braces).

Inside the conf file I do something like this:

<Location /index.php/mynewadminname>
  Order deny,allow
  deny from all
  allow from
  allow from
<Location /mynewadminname>
  Order deny,allow
  deny from all
  allow from
  allow from

Where and are two allowed IP addresses. Might be an alternative.


Allow admin access by ip

RewriteCond %{REMOTE_ADDR} !^10\.125\.192\.50

RewriteCond %{REMOTE_ADDR} !^10\.125\.192\.50

RewriteCond %{REQUEST_URI} admin [NC]

RewriteRule ^(.*)$ / [F,L]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.