How can I make an HTML (and CSS/PHP/JavaScript) document which only allows certain IP addresses on a page?

(I am not asking how to find IP address with PHP, but how to allow access to a page based on an IP address.)

How can I make an HTML (and CSS/PHP/JavaScript) document which only allows certain IP addresses on a page?

(I am not asking how to find IP address with PHP, but how to allow access to a page based on an IP address.)

• javascript
• php
• html

• 1 Have a look here and see if this is what you want -- javascriptkit./script/script2/blockip.shtml – Christopher Bennett Commented May 18, 2019 at 23:09
• @ChristopherBennett This should work. Thanks! – Voldemort's Wrath Commented May 18, 2019 at 23:10

5 Answers 5

put this on the top of your php file and update the allowedIps variable with the IPs that you want to allow.

$allowedIps = ['198.x.x.x', '200.x.x.x'];
$userIp = $_SERVER['REMOTE_ADDR'];

if (!in_array($userIp, $allowedIps)) {
    exit('Unauthorized');
}

for non PHP files (eg .html, .css) you will have to update your .htaccess file to add file specific permission. The following SOF thread should help: (assuming you are using apache server)

.htaccess: how to restrict access to a single file by IP?

If you dont want to bother with the code, put your site on Cloudflare and block ips

Usually, IP restrictions are done at the web-server configuration level, so that unauthorized IPs simply can't reach your code at all.

It would actually be quite messy to try to do this kind of check within your application – "you'd undoubtedly miss one" – but the server can easily do it for you.

(I do not remend attempting to use IPs for privilege checking and so forth ... "IPs change. Frequently. Very messy. Very ...")

Even stronger yet would be firewalls, and maybe VPNs. You really want to keep intruders as far away as possible and to give them as little information as possible. (For instance, why should they even be able to detect that the web-server exists?) Strive to make the entire setup as "hardened" as possible.

I tried

$allowedIps = ['198.x.x.x', '200.x.x.x'];
$userIp = $_SERVER['REMOTE_ADDR'];

if (!in_array($userIp, $allowedIps)) {
    exit('Unauthorized');
}

and I get blocked by the very IP I am accessing it by. How do I fix this?

Try this with PHP :

function CheckIPAccess() {
  //allowed IP. Change it to the IP addresses you want to allow to access your webpage

  $allowedip = '127.0.0.1';
  $ip = $_SERVER['REMOTE_ADDR'];
  return ($ip == $allowedip);
}