2

Has anyone ever limited access to Craft's back-end via ip address? What paths should I limit if I'm wanting to ensure only certain ip addresses can post updates? Thanks!

1
3

If you're looking to only allow certain IP addresses to access the entire control panel, you're best bet would be to whitelist them via an .htaccess file.

Something like:

<Limit GET POST>
    order deny,allow
    deny from all
    allow from 1.2.3.4
</Limit>

If you're looking to just allow certain Craft-specific actions by IP address, then you'd have to write a plugin. For example, if you only want certain IP addresses to be able to create an entry, the plugin would listen for the onSaveEntry event, make sure it's a new entry, check if the user has createEntry permissions, if so grab their IP address and make sure it falls in your whitelist.

Just be aware that IP address detection can be spoofed, so you shouldn't be relying on this for any critically sensitive data.

3
  • Thanks Brad. The htaccess solution is what I'm going for... I need to protect the entire control panel. Are there routes/paths outside of the normal control panel URL that I need to consider? For example, perhaps paths used by control panel Ajax requests? – Matt Fordham Apr 21 '15 at 20:46
  • Probably would just need to add 127.0.0.1 and/or the server's public IP address. – Brad Bell Apr 21 '15 at 20:47
  • Would this block visitor's form submissions, e.g. via a search form? – Crafty Cat Oct 6 '18 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.