Apps Artificial Intelligence CSS DevOps Go JavaScript Laravel Linux MongoDB MySQL PHP Python Rust Svelte Vue

How to Whitelist IP Address Ranges with .htaccess

1 min read .
Updated on
How to Whitelist IP Address Ranges with .htaccess

.htaccess is useful for more than URL rewriting and caching. It can also provide an additional access-control layer, including restricting an application to specific IP addresses or IP ranges.

This technique can be useful when:

  • An application is still in development and should only be available to an internal team.
  • You want to protect sensitive paths such as /admin or /api.
  • A server should only be reachable from an office network or VPN.

Whitelist One IP Address

To allow only one IP address:

<RequireAll>
  Require ip 203.0.113.25
</RequireAll>

With this rule, only 203.0.113.25 is allowed. Other clients receive a 403 Forbidden response.

Whitelist Multiple IP Addresses

Use <RequireAny> when more than one address should be accepted:

<RequireAny>
  Require ip 203.0.113.25
  Require ip 198.51.100.10
  Require ip 192.0.2.8
</RequireAny>

Only those three addresses are granted access.

Whitelist an IP Range with CIDR

To allow an entire range, use CIDR notation:

<RequireAll>
  Require ip 203.0.113.0/24
</RequireAll>
  • /24 covers addresses from 203.0.113.0 through 203.0.113.255.
  • The entire subnet is therefore included in the allowlist.

You can also combine individual addresses and ranges:

<RequireAny>
  Require ip 203.0.113.25
  Require ip 198.51.100.0/24
</RequireAny>

Important Notes

  1. Apache 2.4+ → The Require syntax applies to Apache 2.4 and later. Apache 2.2 used Allow from and Deny from.
  2. Test first → Validate access rules in a staging environment whenever possible. A bad rule can lock you out of the application.
  3. Scale appropriately → .htaccess works well for small and medium allowlists. For larger deployments, firewall rules or a WAF are usually easier to manage and more efficient.

Conclusion

IP whitelisting with .htaccess is a simple way to restrict access to a directory or application. It is useful for internal tools, protected APIs, development environments, and other resources that should only be reachable from trusted networks.

DevOps Security Apache Htaccess

Related Posts

.htaccess Rules to Prevent PHP Execution
Published on
.htaccess Rules to Prevent PHP Execution
Public upload directories are a common security-sensitive part of web applications. If an attacker manages to upload a file such as shell.php and the web server executes it, the upload feature can become a route to remote code execution. On Apache, a directory-specific .htaccess configuration can help prevent script execution in locations that should contain only static files. Why .htaccess Can Help Apache supports .htaccess files for directory-level configuration when the server permits the relevant overrides. This makes it possible to apply security rules to a specific directory without changing every virtual-host setting.
DevOps Security Apache htaccess
How to Block IP Ranges with `.htaccess`
Updated on
How to Block IP Ranges with `.htaccess`
One useful feature of Apache is the flexibility of .htaccess. In addition to URL rewriting and caching rules, .htaccess can also restrict access based on IP addresses. If you are dealing with spam bots, brute-force attempts, or unwanted traffic from a particular network, one quick option is to block an individual IP address or an entire range. Block a Single IP Address To block one IP address, use: Copy <RequireAll> Require all granted Require not ip 192.168.1.100 </RequireAll> This blocks 192.168.1.100 while allowing other clients to access the site.
DevOps Apache htaccess Security
Automatically Encrypting Eloquent Model Attributes
Published on
Automatically Encrypting Eloquent Model Attributes
Applications often store fields that deserve additional protection at rest. Laravel can encrypt selected Eloquent attributes before they are written to the database and decrypt them automatically when they are read. For modern Laravel applications, the built-in encrypted cast is preferable to overriding Eloquent’s magic __get() and __set() methods. It integrates with the model casting system and avoids interfering with Eloquent internals. Basic Implementation Define encrypted attributes in the model’s casts:
Laravel Security Encryption
Creating a CA Bundle and Converting an SSL Certificate to .PFX
Published on
Creating a CA Bundle and Converting an SSL Certificate to .PFX
Managing SSL/TLS certificates is a routine task for many developers and system administrators. One common requirement is to combine intermediate certificates into a CA bundle and then convert the certificate and private key into a .pfx file. The .pfx format, also known as PKCS#12, is commonly used when importing certificates into Windows Server and IIS, Microsoft Exchange, and other applications that expect a PKCS#12 bundle. This guide walks through the process.
DevOps SSL
Using Nginx as a Reverse Proxy for a Go Application
Updated on
Using Nginx as a Reverse Proxy for a Go Application
A Go web application often listens directly on an application port such as :8080. If you want users to access it through a normal domain on port 80 or 443, you can place Nginx in front of it as a reverse proxy. Using Nginx in front of a Go service provides several benefits: Client requests reach Nginx before being forwarded to the Go application. TLS termination can be handled at the proxy layer. Multiple application instances can be load balanced. Static assets can be served separately when that architecture makes sense. This guide shows a basic setup.
DevOps Golang Linux Nginx Reverse Proxy
chevron-up