2

I need to set up my .htaccess file to deny access to the site if they are accessing the staging.example.com.

I have a Magento 2 store and have set up deployment using Capistrano, which will be deploying to 2 separate domains: staging.example.com and example.com. They will have the same .htaccess file and I want to allow access to the staging site by IP only.

Currently using Cpanel and you don't have access to the vhost files.

4

You can use something like this code in your DOCUMENT_ROOT/.htaccess file:

RewriteEngine On

RewriteCond %{HTTP_HOST} ^(?:www\.)?subdomain\.com$ [NC]
RewriteCond ${ipmap:%{REMOTE_ADDR}} !^(127\.0\.0\.1|192\.168\.|10\.|1\.2\.3\.4)$
RewriteRule ^ - [F]

Source: answer from anubhava on Stack Overflow

You can also allow specific IP addresses and deny the rest with this:

order deny,allow
allow from 31.24.232.14
allow from 127.0.0.0
allow from 192.168.0.0
deny from all

These might also help:

<If "%{HTTP_HOST} != 'www.example.com'">
Redirect / http://www.example.com/
</If>

There's a good chance this last one is what you want. If the code works, it will detect that the website loaded is not example.com (but your subdomain). And if it's your subdomain it will block all IP addresses except the one that you list in the allow from.

<If "%{HTTP_HOST} != 'www.example.com'">
    order deny,allow
    allow from 31.24.232.14
    allow from 127.0.0.0
    allow from 192.168.0.0
    deny from all
</If>

You could also try:

<If "%{HTTP_HOST} = 'subdomain.example.com'">
    order deny,allow
    allow from 31.24.232.14
    allow from 127.0.0.0
    allow from 192.168.0.0
    deny from all
</If>

For Apache 2.4+

If you're going to use require ip, you may need to do it like this:

Require all denied
Require ip 123.123.123.123

Read more: https://stackoverflow.com/questions/37865658/htaccess-allow-deny-ip-using-require-apache-2-4

Maybe this works?:

<If "%{HTTP_HOST} = 'staging.example.com'">
Require all denied
Require ip 123.123.123.123
</if>

Sources are also showing that you need RequireAny to allow only specific IPs. If that's the case you may have to modify it for your subdomain requirement condition:

<RequireAny>
Require ip 1.2.3.4
Require ip 23.34.45.56
</RequireAny>
  • The last one might work, but I'm trying to stay away from that. Since it's being depreciated. "The Allow, Deny, and Orderdirectives, provided by mod_access_compat, are deprecated and will go away in a future version. You should avoid using them, and avoid outdated tutorials recommending their use." – gabehou Mar 30 '18 at 18:30
  • 1
    Oh wow that's good to know. I use some allow, deny so I'm glad you told me so that my sites don't break if they deprecate this. – Michael d Mar 30 '18 at 18:44
  • Updated my answer for apache 2.4+ – Michael d Mar 30 '18 at 19:10
  • 1
    But I want this rules to only apply to the subdomain staging.example.com – gabehou Mar 30 '18 at 19:13
  • "${ipmap:%{REMOTE_ADDR}}" - This should be simply %{REMOTE_ADDR} (in the RewriteCond directive at the top) - ipmap refers to a rewrite map, which hasn't been defined here. – MrWhite Mar 31 '18 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.