<p>If you're looking to only allow certain IP addresses to access the <em>entire</em> control panel, you're best bet would be to whitelist them via an <code>.htaccess</code> file.</p>

<p>Something like:</p>

<pre><code>&lt;Limit GET POST&gt;
    order deny,allow
    deny from all
    allow from 1.2.3.4
&lt;/Limit&gt;
</code></pre>

<p>If you're looking to just allow certain Craft-specific actions by IP address, then you'd have to write a plugin.  For example, if you only want certain IP addresses to be able to create an entry, the plugin would listen for the <a href="http://buildwithcraft.com/docs/plugins/events-reference#entries-onSaveEntry" rel="nofollow">onSaveEntry</a> event, make sure it's a new entry, check if the user has <a href="http://buildwithcraft.com/docs/users#permissions" rel="nofollow">createEntry</a> permissions, if so <a href="http://buildwithcraft.com/classreference/services/HttpRequestService#getIpAddress-detail" rel="nofollow">grab their IP address</a> and make sure it falls in your whitelist.</p>

<p>Just be aware that IP address detection can be spoofed, so you shouldn't be relying on this for any critically sensitive data.</p>

CC BY-SA 3.0
2015-04-21T20:46:43.813Z
Thanks Brad. The htaccess solution is what I'm going for... I need to protect the entire control panel. Are there routes/paths outside of the normal control panel URL that I need to consider? For example, perhaps paths used by control panel Ajax requests?
Matt Fordham
CC BY-SA 3.0
2015-04-21T20:47:57.920Z
Probably would just need to add `127.0.0.1` and/or the server's public IP address.
Brad Bell
CC BY-SA 4.0
2018-10-06T20:34:00.970Z
Would this block visitor's form submissions, e.g. via a search form?
Crafty Cat
CC BY-SA 3.0
2015-04-20T20:51:50.327Z
2015-04-20T20:51:50.327Z
Brad Bell
<p>Has anyone ever limited access to Craft's back-end via ip address? What paths should I limit if I'm wanting to ensure only certain ip addresses can post updates? Thanks!</p>

CC BY-SA 3.0
2015-04-20T19:59:13.950Z
Hey Matt - are the [built in user permissions](http://buildwithcraft.com/docs/users#permissions) not sufficient? Limiting by route is possible but may quickly become cumbersome!
Aaron Berkowitz
<control-panel><security><htaccess>
Restrict control panel by ip address?
# Restrict control panel by ip address?

(Asked by: username_0 on 2015-04-20)

Has anyone ever limited access to Craft's back-end via ip address? What paths should I limit if I'm wanting to ensure only certain ip addresses can post updates? Thanks!

**Tags:** control-panel, security, htaccess
> **Comments:**
> **username_1**: Hey Matt - are the [built in user permissions](http://buildwithcraft.com/docs/users#permissions) not sufficient? Limiting by route is possible but may quickly become cumbersome!  

---

## 1 answers

### Answer by username_2 on 2015-04-20. Score: 3

If you're looking to only allow certain IP addresses to access the entire control panel, you're best bet would be to whitelist them via an .htaccess file.
Something like:

    order deny,allow
    deny from all
    allow from 1.2.3.4


If you're looking to just allow certain Craft-specific actions by IP address, then you'd have to write a plugin.  For example, if you only want certain IP addresses to be able to create an entry, the plugin would listen for the onSaveEntry event, make sure it's a new entry, check if the user has createEntry permissions, if so grab their IP address and make sure it falls in your whitelist.
Just be aware that IP address detection can be spoofed, so you shouldn't be relying on this for any critically sensitive data.

> **Comments:**
> **username_0**: Thanks Brad. The htaccess solution is what I'm going for... I need to protect the entire control panel. Are there routes/paths outside of the normal control panel URL that I need to consider? For example, perhaps paths used by control panel Ajax requests?  
> **username_2**: Probably would just need to add `127.0.0.1` and/or the server's public IP address.  
> **username_3**: Would this block visitor's form submissions, e.g. via a search form?  

---

