Question: There are some action methods in my WebAPI 2 application where I would like to disable remote accessibility (scheduled administrative tasks). Other action methods should be publicly available. Is an `ActionFilter` the best bet in this case?

Answer: 
FROM book "Pro ASP.NET MVC 4 4th edition":

```cs
public class CustomActionAttribute : FilterAttribute, IActionFilter { 
    public void OnActionExecuting(ActionExecutingContext filterContext) { 
        if (filterContext.HttpContext.Request.IsLocal) { 
            filterContext.Result = new HttpNotFoundResult(); 
        } 
    }

    public void OnActionExecuted(ActionExecutedContext filterContext) { 
        // not yet implemented 
    } 
}

```
I think that cross-origin resource sharing (CORS) will help your if you have local url for your site. You can apply list of origins for public actions and only local origin for your secured actions. For example:

Local:

```cs
[EnableCors(Origins = new[] { "http://localhost", "http://sample.com" })]
public class ValuesController : ApiController
{
......
}

```

and secured:

```cs
[EnableCors(origins: "http://localhost")]
public class ValuesController : ApiController
{
......
}

```

You can find out more details by the next links: [CORS support for ASP.NET Web API](http://aspnetwebstack.codeplex.com/wikipage?title=CORS%20support%20for%20ASP.NET%20Web%20API) and [Scope Rules for [EnableCors]](http://www.asp.net/web-api/overview/security/enabling-cross-origin-requests-in-web-api#scope)