Tips on Web Security

[debraguk]

How do you actually do #13? I can find how to password protect a directory/folder and have to deny IP addresses but not allow them. Do I use the same feature but just blocking the addresses otside of my IP address range?

[JPC-Rizwan]

The point # 13 refers to blocking access for certain admin sections of the application/account, e.g. admin section. With the block in place , any IP other than the ones allowed will not be able to access the related url. This is different than the normal password protection for any directory as in that case every one can access url , but need logins to further access that url.

You can do this by first adding a 'deny from all' in your .htaccess file and then adding 'allow from 1.2.3.4' below it , where 1.2.3.4 will be your IP from which you want to allow access.
Multiple 'allow from IP' can be added to the .htaccess file if you want to allow access from more than one IP.