.htaccess code to only allow access to my IP address?

Is there any code I can add to the .htaccess file on my development site to only allow access to the admin IP address? i.e only allow access to the store to the admin when logged into the admin area?

Order Deny,Allow
Deny from all
Allow from adminip

I was test with my site http://trihung.com

thanhv:

Order Deny,Allow
Deny from all
Allow from adminip

> 
> I was test with my site <http://trihung.com>

so the .htaccess dynamically knows what 'adminip' is??

nope.. that doesnt work

im assuming you are meaning to hard code in my ip.. my ip changes, I want it to allow based on the current admin ip.

anyone else know how to achieve this?

You could try putting the site into "maintenance" mode. This will by default only allow the IP Addresses you add in the admin area to browse the store. Although if I remember correctly some features such as downloadable products do not always work in "maintenance" mode. You could also just go in via SFTP / FTPS and edit the allowed IP address each time.

If you just don't want search engines to crawl / index the site you can add a robots.txt to request they ignore all URLs on your site / folder.

If you do not want the world to access your development site:

1. Site on a PUBLIC facing webserver, use static IPs on the clients and configure to allow only those IPs.
2. Site on a PUBLIC facing webserver, use a authentication method (Apache or another method).
3. Move the development site to a NON-PUBLIC facing webserver, use VPN / SSH Tunnel / etc to access network remotely. This lets multiple team members work on the website at the same time. In conjunction with version control (such as GIT / SVN) and project management software this works well.
4. Move the development site to your local computer, block external requests. Good for local testing of websites + email generation.
   I do a combination of the last two... I test my changes locally and when done: commit to VCS (in my setup this goes to a shared development server for regression + unit testing) and log my changes to the PM software. In a few cases I have had a business need for a PUBLIC facing webserver for testing, but it is rare.

philip937:

nope.. that doesnt work

im assuming you are meaning to hard code in my ip.. my ip changes, I want it to allow based on the current admin ip.

anyone else know how to achieve this?

Set up to use a 'Dynamic DNS' and use hostname instead of IP address in the 'Allow From'

Alternatively, ask your ISP the range of IP addresses from the pool they assign to you and allow only those IP's. (keeping in mind that this will still allow anyone using the same ISP as you 'unrestricted' access.

If you prefer to keep things simpler, just restrict the admin folder(s) via a .htaccess password. It's just as secure, with little chance of locking yourself out.

Cheers
Rod

How does the store front look in maintainance mode? Is there just access to a single holding page unless you are admin? Where are the ip addresses set?
Thanks

just tried it, down for maintenance is perfect, does exactly what I need :o)

philip937:

How does the store front look in maintainance mode? Is there just access to a single holding page unless you are admin?

Yes (as you have discovered).

What you may not realise is that this page can be customised. Darnit. I forget the name of the file.

philip937:

Where are the ip addresses set?
Thanks

This is set by ZenCart based on the IP address of the admin user currently logged in (I think).

I don't know when this gets reset, but I'd assume that if you happened to lose connection to your ISP whilst in maintainance mode and get assigned a new IP address you could find yourself locked out of the system (Don't panic, this would be rare, and there are ways to recover)

Cheers
Rod

No, you wouldn't lock yourself out. All you'd need to do is login to your Admin (since maintenance mode only affects the storefront) and update the list of IPs which are allowed to bypass maintenance mode. Admin->Configuration->Website Maintenance.

DrByte:

No, you wouldn't lock yourself out. All you'd need to do is login to your Admin (since maintenance mode only affects the storefront) and update the list of IPs which are allowed to bypass maintenance mode. Admin->Configuration->Website Maintenance.

Doh! Rather obvious now you've explained it. :)

Cheers
Rod

The only consideration is that certain shipping and payment modules do not function when the site is in maintenance mode - so these must be tested in a "live" site.

But yes... the IP-restricted maintenance mode is one of zencart's most useful features.

thanks guys, I dont need it for testing i'll just simply disable maintanance mode when testing. however im pretty sure I was logged into the admin when I got the maintancance screen up so not sure im understanding about he admin being able to browse with the limited functionality?

anyone work out how you customise the page that shows? currently on my set up it shows the head navigation and a few other bits, but this may be my template and me hacking it too bits :p

philip937:

not sure im understanding about he admin being able to browse with the limited functionality?When you supply a list of authorized IP addresses and turn on maintenance mode, then anyone visiting from that IP will still see the shop as (almost) normal despite it being down for maintenance. It's not really got specific "limited" functionality, but rather will show a messageStack banner message indicating that the store is in maintenance mode.

While some might argue that older versions didn't support testing of external services while in maintenance mode, that old "limitation" is more related to those individual services than to maintenance mode itself.

philip937:

anyone work out how you customise the page that shows? currently on my set up it shows the head navigation and a few other bits, but this may be my template and me hacking it to bits
You can control many of those things in the Website Maintenance configuration screen. And if that's not enough control, there's the template file for the maintenance page ... which follows the same naming convention as all other template files.

DrByte:

When you supply a list of authorized IP addresses

Hey DeByte. Where do I supply the IP addresses?

philip937:

Hey DeByte. Where do I supply the IP addresses?
on the same "Website Maintenance configuration screen" that Dr Byte mentioned

ah ok, must have missed that completely! cheers