My company is working on a new web app and it's website is developed by outsourced company (let's say under beta.mydomain.com). Of course this site has some user-management mechanisms, but there are huge part of front-end, that are meant to be visible to even not-logged user.

Lately this beta site was leaked. What is the best way to protect that website while it is being under development? My goal is to protect that page/domain (i.e. via password) with lowest possible ingerention in the outsourced website's code (because it's still under dev).

I was thinking about some kind of wrapper-page (with logging mechanisms) and .htaccess file that would check for redirection from that wrapper, but I wanted to ask first what is your experience in that matter? How can I achieve that?

  • simplest immediately obvious solution: place a block on the firewall allowing connections only from appropriate IP ranges (e.g. your offices, your outsourced company's offices)
    – TZHX
    Commented Apr 7, 2015 at 8:50
  • That wouldn't work because we have co-workers from all around country, with different and often dynamic IPs
    – Gacek
    Commented Apr 7, 2015 at 9:04
  • Basically most of public user try to access site via main domain like www.example.com so you can just replace your main page with "Under construction" page. and as your developers are working they know each page specific URL so they can access all inner pages. Commented Apr 7, 2015 at 9:45
  • Well, we had such mechanism - main page is some kind of landing page, and under beta.mydomain.com we had page "for developers only". But it leaked and we need to find other solution,
    – Gacek
    Commented Apr 7, 2015 at 11:01
  • HTTP authentication?
    – MrWhite
    Commented Apr 7, 2015 at 11:03

3 Answers 3


Use HTTP Authentication. When visiting the page people would be prompted with a login box. If they log in the site works as expected, if they don't have valid login credentials they get a "401 - Unauthorized" error and nothing else.

You don't have to change your website code of anything for this. It can be enabled from your hosting control panel, of from your .htaccess file.


Well the best and quickest way of doing this, and I think it's the more plausible as well is to restrict access for every IP Address and only allow your own IP Address to have access to the website.
This can be done via htaccess, by adding this rule:

order deny,allow
deny from all
allow from 111.222.333.444

Later if you need to allow more than one IP Address, just add below another Addresses

allow from
  • As I said in other comments, we have developer working remotely from all of the country, so we cannot use IP filtering.
    – Gacek
    Commented Apr 8, 2015 at 11:41
  • hmm I see, but you can always add various IP Addresses like I mentioned in the answer
    – Chun
    Commented Apr 8, 2015 at 12:00
  • Still cannot do that - most of our workers have dynamic IP
    – Gacek
    Commented Apr 8, 2015 at 12:08

If the beta has an admin side, or even accounts in general, just use those. Don't render the site unless they are logged in as an admin or a dev. This would also prevent it from being crawled since bots wouldn't be logged in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.