Currently, my website is under maintenance. I want to be the only person who's able to access/view the website online until I finish maintenance. How to set restrictions to others? I hate stalkers.

2 Answers 2


Currently my website is under maintenance.

If your website is only temporarily "under maintenance" and has already been live and indexed by search engines then you should consider returning a "503 Service Unavailable" HTTP response code with perhaps a Retry-After HTTP header indicating when the site is expected to be available again. Instead of simply blocking access to the site with a 401 or 403 response.

The 503 response is specifically for situations when the site is "down for maintenance" and can help lessen the effect any downtime might have on your search engine ranking.

This is easily achieved using mod_rewrite (and mod_headers) in htaccess in order to block IP addresses. However, as mentioned in comments above, blocking IPs (or rather only allowing a select few IPs) can be problematic unless the IPs you are allowing are (reasonably) static or you can allow IP-ranges (if your content isn't too sensitive).

To achieve something like this in htaccess:

# Declare custom error document
ErrorDocument 503 /errordocs/e503.php

RewriteEngine On
RewriteCond %{REMOTE_ADDR} !=
RewriteCond %{REMOTE_ADDR} !=
RewriteCond %{ENV:REDIRECT_STATUS} !=503
RewriteRule ^ - [R=503,L]

Only the IPs and will be allowed access. Then to send an unconditional Retry-After header:

Header always set Retry-After "Wed, 25 Dec 2013 04:00:00 GMT"

(This could be sent conditionally based on the value of an environment variable for instance.)

However, personally I tend to pass the date/time directly to my error document and allow my script to set the header conditionally and display a meaningful message to the user at the same time (this would also be reqd if you didn't have mod_headers installed):

# Declare custom error document, passing date/time for Retry-After header
ErrorDocument 503 /errordocs/e503.php?RetryAfter=2013-12-25+04:00:00
  • Thank you for your reply and sorry for my late response. I got a static IP from my ISP, but I don't know how to only allow my IP getting access to the website and denying all other IPs, there is no such an option like that in the cPanel's IP deny manager. Thank you again. Commented Dec 9, 2013 at 18:13
  • 1
    cPanel's IP Deny Manager is just for denying IP's, not for allowing some and denying all others, although you could perhaps reverse the logic, but that's messy. cPanel simply edits the .htaccess file in the root of your site, which you can easily do yourself, and by doing it yourself you have a lot more power. The code I posted above (first code block) specifically allows just 2 IP addresses. Delete one of these if you only want to allow one IP address.
    – MrWhite
    Commented Dec 9, 2013 at 19:13

I can see that you selected "cpanel" as a tag. In your cPanel you should have an option to password protect directories. It looks like this: enter image description here

There you can setup a username and password for your website root. In this way only people that have the right credentials can see the site.

  • 1
    While the answer is good, it must be also noted that when using .htpasswd for directories that hold sensitive data you should use a very complex password and username, .htpasswd can be easily brute-forced because as default you get unlimited attempts meaning people can easily run dictorarny hacks on it. If sensitive data then just ensure that a temporary ban for X attempts in X seconds. Fail2ban for example will make your htpasswd more secure. Commented Nov 29, 2013 at 13:55
  • 1
    good highlight. it's also possible to use the IP Deny Manager to allow access to the site only the listed IP addreses
    – Pikk
    Commented Nov 29, 2013 at 15:15
  • Ya you can restrict by IP if you want. Can be kinda annoying unless you block by C-Class IP or unless your on Static IP then np. Commented Nov 29, 2013 at 23:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.