How to Allow/Deny Website Access Using .htaccess

Website security is very important for website owners and developers. One of the best ways to keep your website safe from unauthorized access is by using .htaccess files. These files, used by the Apache web server, let you set access rules for your website. In this guide, we will explain different ways to restrict access to your website using .htaccess. This includes restricting access by IP address, password protection, and more.

1. What is .htaccess?

.htaccess (short for “hypertext access”) is a configuration file used by Apache web servers to manage settings for a specific directory. These settings can include access control and URL redirection. By placing an .htaccess file in your website’s root directory (usually named “public_html”), you can apply rules to your entire website or a specific folder.

Advertisement

2. Restricting Access by IP Address

To restrict access to your website based on IP addresses, follow these steps:

1. Create or edit an existing .htaccess file in the desired directory.
2. Add the following code, replacing “your_ip_address” with the IP address you want to grant access to:

   
   Order Deny,Allow
   Deny from all
   Allow from your_ip_address
   
   

3. Save the .htaccess file and upload it to your server. The changes should take effect immediately.

3. Password-Protecting Directories

To password-protect a specific directory, follow these steps:

1. Create a new file named “.htpasswd” in a secure location outside your website’s root directory.
2. Use an online tool or the command “htpasswd” to generate a username and password combination, and add it to the .htpasswd file.
3. In the desired directory, create or edit the existing .htaccess file, and add the following code:

   
   AuthType Basic
   AuthName "Restricted Area"
   AuthUserFile /path/to/your/.htpasswd
   Require valid-user
   
   

4. Replace “/path/to/your/.htpasswd” with the actual path to the .htpasswd file.
5. Save the .htaccess file and upload it to your server. The changes should take effect immediately.

4. Blocking Access to Specific Files and File Types

To block access to specific files or file types, add the following code to your .htaccess file, adjusting the file extension(s) as needed:

<FilesMatch "\.(file_extension1|file_extension2)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>>

5. Restricting Access Based on User Agent

To restrict access based on user agents (e.g., specific browsers or bots), add the following code to your .htaccess file:

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} user_agent_string [NC]
RewriteRule .* - [F]

Replace “user_agent_string” with the user agent string you want to block.

6. Combining Multiple Access Restrictions

You can combine different access restrictions in a single .htaccess file to create more complex rules. For example, to restrict access to a specific IP address and user agent, add the following code:

Order Deny,Allow
Deny from all
Allow from your_ip_address

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} user_agent_string [NC]
RewriteRule .* - [F]

Replace “your_ip_address” with the desired IP address and “user_agent_string” with the user agent string you want to block.

7. Denying Access from a Specific Domain

To deny access to your website from visitors coming from specific domains, add the following code, replacing “blocked_domain.com” with the actual domain you want to block:

RewriteEngine On
RewriteCond %{HTTP_REFERER} blocked_domain\.com [NC]
RewriteRule .* - [F]

This configuration will check the HTTP_REFERER header to identify the referrer domain and deny access if it matches the blocked domain. Note that the HTTP_REFERER header can be easily spoofed, so this method is not foolproof. However, it can still be useful for discouraging casual hotlinking or unwanted traffic from specific domains.

8. Denying Access during Specific Hours

To deny access to your website during specific hours, you can use the mod_rewrite module with the TIME_HOUR variable. Follow these steps:

1. Create or edit an existing .htaccess file in the desired directory.
2. Add the following code, replacing “start_hour” and “end_hour” with the hours you want to block access:

   
   RewriteEngine On
   RewriteCond %{TIME_HOUR} >=start_hour
   RewriteCond %{TIME_HOUR} <=end_hour
   RewriteRule .* - [F]
   
   

3. For example, if you want to block access between 2 AM and 4 AM, the code would look like this:

   
   RewriteEngine On
   RewriteCond %{TIME_HOUR} >=02
   RewriteCond %{TIME_HOUR} <=04
   RewriteRule .* - [F]
   
   

This configuration will check the server's current time and deny access to your website during the specified hours. Keep in mind that this method relies on the server's time zone, which might be different from your local time. Be sure to adjust the hours accordingly if necessary.

Conclusion

.htaccess files offer a powerful way to manage access control on your website. By understanding and implementing the different access restrictions discussed in this guide, you can effectively protect your website from unauthorized access, enhance its security, and create a safer browsing experience for your visitors. Remember to test your .htaccess rules thoroughly and to back up your files before making any changes to your server.