I've created an action that calls a service. The action will be called by a cron task. I want to set this up so that ONLY the cron task can call the action. It's important that it can not be run by any other means (via HTTP, CURL request etc.).

Any ideas on how to do that?

UPDATED (I think this will work):

public function actionMethod() 

    $key = craft()->request->getParam('key');

    if($key == 'random-string' && $_SERVER['REMOTE_ADDR'] == 'my-servers-ip-address') {


Note, this is twinned with a cron tab that looks like: curl -H "X-Requested-With: XMLHttpRequest" http://sitename.co.uk/actions/plugin_name/Method?key=random-string

2 Answers 2


Have your cron job pass in a super-duper top-secret key via the querystring.


You can use a site like www.guidgen.com to generate the key.

Then just have your action check for that key, make sure it matches and bail if it doesn't.

  • Thanks Brad, does my updated question look like it would work to you?
    – H2ONOCK
    Nov 19, 2015 at 17:44
  • 1
    Looks good to me!
    – Brad Bell
    Nov 19, 2015 at 17:50

Along with Brad's answer, one additional easy check in your code would be to see if the $_SERVER['REMOTE_ADDR'] is the server's IP and then bail if it's not.

That means you'd have to spoof the server's IP address AND guess the key. No better than a username/password combination but should be secure enough IMO.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.