Has anyone ever limited access to Craft's back-end via ip address? What paths should I limit if I'm wanting to ensure only certain ip addresses can post updates? Thanks!


1 Answer 1


If you're looking to only allow certain IP addresses to access the entire control panel, you're best bet would be to whitelist them via an .htaccess file.

Something like:

<Limit GET POST>
    order deny,allow
    deny from all
    allow from

If you're looking to just allow certain Craft-specific actions by IP address, then you'd have to write a plugin. For example, if you only want certain IP addresses to be able to create an entry, the plugin would listen for the onSaveEntry event, make sure it's a new entry, check if the user has createEntry permissions, if so grab their IP address and make sure it falls in your whitelist.

Just be aware that IP address detection can be spoofed, so you shouldn't be relying on this for any critically sensitive data.

  • Thanks Brad. The htaccess solution is what I'm going for... I need to protect the entire control panel. Are there routes/paths outside of the normal control panel URL that I need to consider? For example, perhaps paths used by control panel Ajax requests? Apr 21, 2015 at 20:46
  • Probably would just need to add and/or the server's public IP address.
    – Brad Bell
    Apr 21, 2015 at 20:47
  • Would this block visitor's form submissions, e.g. via a search form?
    – Crafty Cat
    Oct 6, 2018 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.