How to only allow certain IPs to hit specific HTML pages?

rolinger

• February 04, 2022 05:50

I am looking for any Apache or CSF method that will allow me to help better lock down my web server. All my public facing pages are *.HTML pages, all my server processing files are labeled .PHP. Meaning only .PHP files should be accessed by HTML files from my own servers. At the moment, all of my PHP files have a function that looks for the client IP - if its not one of my servers requesting the PHP page, then spit out an "Invalid Request" page and exit the script. However, this means the external user is still getting to my web PHP files...which is permitting a connection and server resources. Is there any method in (preferably) CSF, or even Apache, that will only allow certain IPs to access specific files?

• 

  cPRex Jurassic Moderator

  • February 04, 2022 14:47

  Hey there! Inside cPanel there is the IP Blocker tool. Using that interface adds the following code to the local .htaccess file for the user: order allow,deny allow from all deny from 1.2.3.4
  so you could use that template to manually add a list of IPs you don't want to access the site. As for the firewall level, I don't have any details that would let you do per-domain or per-vhost, as those would be all or nothing.

  0
• 

  rolinger

  • February 04, 2022 17:28

  @cPRex - thanks for the response (again). Can the reverse of that be done...only permit a few IPs, deny the rest? order allow,deny allow from 1.1.1.1, 2.2.2.2, 127.0.0.1l deny from all
  As well....how does that target my *.php files only? I am not too proficient with Apache .htaccess files.

  0
• 

  cPRex Jurassic Moderator

  • February 04, 2022 17:39

  Sure - something like this would do the trick for PHP files: Order allow,deny allow from 1.1.1.1, 1.1.1.2, etc..... Deny from all
  There's much more reading on the .htaccess rules here:

  0

Please sign in to leave a comment.