How would you make portions of Craft available to only people that are "on the domain" and then let the rest of it be public facing? Would you need two instances of craft on 2 servers? One which is accessible only from "inside" and another that the public can access?

Would this entail running Craft on one webserver and the front-end on another? This way the webserver with craft on it is only accessed internally but the front-end can be accessed outside?

edit: I only want CP to be accessed by people who are logged in and on the work network. For security reasons a simple login is not enough.

3 Answers 3


The back end of craft (admin log in section or Control Panel) can only be accessed by admins and users that an admin has added. The front end will always be visible to everyone while the backend will be password protected.

If you want separate front end displays for people who have usernames and passwords and those who dont, you could add a front end log in form:


And display one set of templates for those who are logged in and another for those who arent logged in via conditional statements e.g.

{% if currentUser %} Protected info {% else %} public Info {% endif %}

If this isn't quite the answer you're looking for could you be slightly more specific with what you mean by "on the domain". Describe exactly what you're looking to achieve.

  • I updated it. By "on the domain" I mean the CP and certain functionalities on the website can only be accessed by those who have the admin password/login AND are accessing it directly from the work network.
    – Exziled
    Oct 28, 2015 at 14:52
  • Ok so you can definitely create password protection and allow for specific functionalities to those with logins. In the CP this can be further customised in the users permissions sections. Customising functionality directly for your work network however may be problematic. You could try and add some configuration dependent on IP address, possibly in the config.php, but as far as I'm aware there isnt anything built into craft that would give this "out of the box". Oct 28, 2015 at 15:27

Assuming your network is behind a router that's setup for DHCP that's handing out a block of IP addresses (typically 192.168.xxx.xxx), you could protect pages using craft.request.getIpAddress() and checking that it's within your allowed IP range.

Keep in mind that's not the most secure method in the world given that it's fairly trivial to spoof the IP address headers on a request.

Alternatively, if your network has a central login authority (like an Active Directory server), then you're looking at creating a Craft plugin that authenticates with something like LDAP to provide proper authentication/authorization for areas of your site.

  • That's exactly what it is. We use AD here so I'm looking to find a way to validate that they are on this domain and then allow them to log in. I'm very new to craft and all of this so I'm still trying to wrap my head around it and the best way to ask these sorts of questions!
    – Exziled
    Oct 28, 2015 at 15:39
  • Probably worth reading, then: craftcms.stackexchange.com/a/5071/57
    – Brad Bell
    Oct 28, 2015 at 16:55
  • I'm surprised Craft doesn't offer up a template variable with just $_SERVER['REMOTE_ADDR']? Just looked at the code and it goes through some hoops to get the "right" IP but if you're on a trusted LAN, you don't need the checks... Oct 29, 2015 at 4:08
  • @RitterKnight We've got it at the PHP level with craft()->request->getUserHostAddress(). No one has ever requested to have it exposed to Twig, though.
    – Brad Bell
    Oct 29, 2015 at 4:10
  • @Brad: Yeh, probably for good reason... (if you're going to limit via IP and are serious about security, you do it on the web server.) Oct 29, 2015 at 4:18

I'm assuming the web server is "local" and sits behind the firewall with the rest of the NAT'd work group? Depending on what pages you need to limit access, you could lock it down at the NAT/server level.

If it were me, I'd do something like companyintranet.whatever.com and use Craft's routing to set up the company only pages (on say a separate structure section). That way, they don't get accidentally mingled in with the rest of the public facing pages. As long as all pages point back to a single CP instance, that's covered on Craft's license.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.