Question

I have a folder which contains an admin panel – no password or session management is on the script. The URL is complex to get too. To save time before making an admin login system. Can I restrict a folder and all sub folders and files via .htaccess or should I make a PHP include which checks an Array list of IPs and then just does die() or redirect Header() to external source?

Thanks

Answer 1

Using .htaccess sure will be easier since you don’t have to write a wrapper around any non-php file that might exists in your directories.

You will first Deny from all and then use Allow from ip.ip.ip.ip to allow a certain ip to get access, repeat step #2 as many times as neccessary.

Order deny, allow
Deny from all

Allow from 127.0.0.1
Allow from 192.168.1.13

---

Using PHP you could check whether $_SERVER['REMOTE_ADDR'] is in your array of valid ips, if so grant the user access… otherwise; HALT!

if (in_array ($_SERVER['REMOTE_ADDR'], array ('127.0.0.1', '192.168.1.13')) == false) {
  die ('restricted access');
}

^{post written and edited using my blackberry, sorry for any minor errors (including formatting)}