Answers.Body: <p>If you're looking to only allow certain IP addresses to access the <em>entire</em> control panel, you're best bet would be to whitelist them via an <code>.htaccess</code> file.</p>
  
  <p>Something like:</p>
  
  <pre><code>&lt;Limit GET POST&gt;
      order deny,allow
      deny from all
      allow from 1.2.3.4
  &lt;/Limit&gt;
  </code></pre>
  
  <p>If you're looking to just allow certain Craft-specific actions by IP address, then you'd have to write a plugin.  For example, if you only want certain IP addresses to be able to create an entry, the plugin would listen for the <a href="http://buildwithcraft.com/docs/plugins/events-reference#entries-onSaveEntry" rel="nofollow">onSaveEntry</a> event, make sure it's a new entry, check if the user has <a href="http://buildwithcraft.com/docs/users#permissions" rel="nofollow">createEntry</a> permissions, if so <a href="http://buildwithcraft.com/classreference/services/HttpRequestService#getIpAddress-detail" rel="nofollow">grab their IP address</a> and make sure it falls in your whitelist.</p>
  
  <p>Just be aware that IP address detection can be spoofed, so you shouldn't be relying on this for any critically sensitive data.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-21T20:46:43.813Z
Answers.Text: Thanks Brad. The htaccess solution is what I'm going for... I need to protect the entire control panel. Are there routes/paths outside of the normal control panel URL that I need to consider? For example, perhaps paths used by control panel Ajax requests?
Answers.UserDisplayName: Matt Fordham
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-21T20:47:57.920Z
Answers.Text: Probably would just need to add `127.0.0.1` and/or the server's public IP address.
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-10-06T20:34:00.970Z
Answers.Text: Would this block visitor's form submissions, e.g. via a search form?
Answers.UserDisplayName: Crafty Cat
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-20T20:51:50.327Z
Answers.LastActivityDate: 2015-04-20T20:51:50.327Z
Answers.UserDisplayName: Brad Bell
Body: <p>Has anyone ever limited access to Craft's back-end via ip address? What paths should I limit if I'm wanting to ensure only certain ip addresses can post updates? Thanks!</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-20T19:59:13.950Z
Comments.Text: Hey Matt - are the [built in user permissions](http://buildwithcraft.com/docs/users#permissions) not sufficient? Limiting by route is possible but may quickly become cumbersome!
Comments.UserDisplayName: Aaron Berkowitz
Tags: <control-panel><security><htaccess>
Title: Restrict control panel by ip address?
ThreadText: # Restrict control panel by ip address?
  
  (Asked by: username_0 on 2015-04-20)
  
  Has anyone ever limited access to Craft's back-end via ip address? What paths should I limit if I'm wanting to ensure only certain ip addresses can post updates? Thanks!
  
  **Tags:** control-panel, security, htaccess
  
  > **Comments:**
  > **username_1**: Hey username_0 - are the [built in user permissions](http://buildwithcraft.com/docs/users#permissions) not sufficient? Limiting by route is possible but may quickly become cumbersome!  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2015-04-20. Score: 3
  
  If you're looking to only allow certain IP addresses to access the *entire* control panel, you're best bet would be to whitelist them via an `.htaccess` file.
  
  Something like:
  
  ```
  <Limit GET POST>
      order deny,allow
      deny from all
      allow from 1.2.3.4
  </Limit>
  
  ```
  
  If you're looking to just allow certain Craft-specific actions by IP address, then you'd have to write a plugin. For example, if you only want certain IP addresses to be able to create an entry, the plugin would listen for the [onSaveEntry](http://buildwithcraft.com/docs/plugins/events-reference#entries-onSaveEntry) event, make sure it's a new entry, check if the user has [createEntry](http://buildwithcraft.com/docs/users#permissions) permissions, if so [grab their IP address](http://buildwithcraft.com/classreference/services/HttpRequestService#getIpAddress-detail) and make sure it falls in your whitelist.
  
  Just be aware that IP address detection can be spoofed, so you shouldn't be relying on this for any critically sensitive data.
  
  > **Comments:**
  > **username_0**: Thanks username_2. The htaccess solution is what I'm going for... I need to protect the entire control panel. Are there routes/paths outside of the normal control panel URL that I need to consider? For example, perhaps paths used by control panel Ajax requests?  
  > **username_2**: Probably would just need to add `127.0.0.1` and/or the server's public IP address.  
  > **username_3**: Would this block visitor's form submissions, e.g. via a search form?  
  
  ---
  
  