My company is working on a new web app and it's website is developed by outsourced company (let's say under beta.mydomain.com). Of course this site has some user-management mechanisms, but there are huge part of front-end, that are meant to be visible to even not-logged user.

Lately this beta site was leaked. What is the best way to protect that website while it is being under development? My goal is to protect that page/domain (i.e. via password) with lowest possible ingerention in the outsourced website's code (because it's still under dev).

I was thinking about some kind of wrapper-page (with logging mechanisms) and .htaccess file that would check for redirection from that wrapper, but I wanted to ask first what is your experience in that matter? How can I achieve that?

  • simplest immediately obvious solution: place a block on the firewall allowing connections only from appropriate IP ranges (e.g. your offices, your outsourced company's offices) – TZHX Apr 7 '15 at 8:50
  • That wouldn't work because we have co-workers from all around country, with different and often dynamic IPs – Gacek Apr 7 '15 at 9:04
  • Basically most of public user try to access site via main domain like www.example.com so you can just replace your main page with "Under construction" page. and as your developers are working they know each page specific URL so they can access all inner pages. – Helping Hands Apr 7 '15 at 9:45
  • Well, we had such mechanism - main page is some kind of landing page, and under beta.mydomain.com we had page "for developers only". But it leaked and we need to find other solution, – Gacek Apr 7 '15 at 11:01
  • HTTP authentication? – MrWhite Apr 7 '15 at 11:03

Use HTTP Authentication. When visiting the page people would be prompted with a login box. If they log in the site works as expected, if they don't have valid login credentials they get a "401 - Unauthorized" error and nothing else.

You don't have to change your website code of anything for this. It can be enabled from your hosting control panel, of from your .htaccess file.


Well the best and quickest way of doing this, and I think it's the more plausible as well is to restrict access for every IP Address and only allow your own IP Address to have access to the website.
This can be done via htaccess, by adding this rule:

order deny,allow
deny from all
allow from 111.222.333.444

Later if you need to allow more than one IP Address, just add below another Addresses

allow from
  • As I said in other comments, we have developer working remotely from all of the country, so we cannot use IP filtering. – Gacek Apr 8 '15 at 11:41
  • hmm I see, but you can always add various IP Addresses like I mentioned in the answer – Chun Apr 8 '15 at 12:00
  • Still cannot do that - most of our workers have dynamic IP – Gacek Apr 8 '15 at 12:08

If the beta has an admin side, or even accounts in general, just use those. Don't render the site unless they are logged in as an admin or a dev. This would also prevent it from being crawled since bots wouldn't be logged in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.