Question

<?php if($_SERVER['REMOTE_ADDR'] != 'xx.xx.xx.xx') { 
header("Location: http://google.com");
} ?> 

Is this a good way to block certain IP addresses from accessing some folders on my windows server ?

Or it can be intercepted with proxy softwares like webscarab and the originating IP address could be modified to bypass this ?

Answer 1

It can bypassed with any proxy with has a different IP address to the one you are blocking. You could check X-Forwarded-For (dig it out with apache_request_headers() if you are using Apache), but this is much easier to spoof if you give it precedence over $_SERVER['REMOTE_ADDR'].

Also, I could ignore your Location header. Put an exit after it as well.