An IP-based rule can prevent requests from a known address from reaching part of a website. It is useful for a specific abusive source, but dynamic addresses, VPNs and shared networks mean it is not a complete security control. Use current Apache authorization syntax rather than older Order, Allow and Deny examples.
These instructions apply where the web server supports Apache-compatible .htaccess rules. Native NGINX does not read this file. A CDN or reverse proxy can also affect the request seen by the origin server. Keep File Manager or SFTP available so you can restore the previous file if a rule prevents browser access.
IN THIS ARTICLE
01 Block a specific address
- Confirm the address in reliable access logs and understand whether a proxy is involved. Do not block a shared proxy address when your intention is to block one visitor.
- Back up
.htaccessand add a block scoped to the website or directory you want to protect. Replace the documentation address below with the confirmed source.
<RequireAll>
Require all granted
Require not ip 192.0.2.10
</RequireAll>The positive grant is required because a negated requirement cannot authorize a request by itself. Existing authorization rules can interact with this block, so review the surrounding file before combining them. Ask support for the correct compatible syntax if your server does not implement Apache 2.4 authorization directives.
02 Verify and manage the rule
- Test an ordinary visitor connection and confirm the site still works. Use a controlled test from the blocked address if available.
- Review subsequent logs to see whether the unwanted traffic stopped. A rule at the origin cannot prevent the connection from consuming resources at an upstream layer.
- Record why the rule was added and review it later. Remove it if the address changes ownership or the temporary incident ends.
How should I block an IP address when my site uses a CDN?
Origin logs and access rules must receive the real client address through a correctly configured trusted proxy integration. Do not trust an arbitrary visitor-supplied forwarding header. A CDN firewall rule can be a better place to block a source before it reaches the hosting account. If you lock yourself out, restore the file through File Manager or SFTP.