Advanced .htaccess Security – Allow or Block Specific IPs From Your Website

The more I use the .htaccess file the more I appreciate its value. My next valuable lesson in .htaccess security deals with allowing and blocking access to a web server from a specific IP address. Reasons for doing this include:

• Keeping a known hacker/bot from accessing your website
• Allowing only your IP address to view your website (while it's in development, for example)
• Allowing only trusted persons into your website (if your users' IP's stay the same, that's more secure than user/pass)
• Disallowing persons from a specified country (or any known location) from your website
• Banning persons from your website

The Code

<limit GET POST PUT>
order deny,allow
deny from 202.57.377.22
deny from 8.77.88.33
allow from all
</limit>

The above code bans the two IP addresses from accessing the website.

Chances are you wont do this often. I do, however, believe that you should use this for your development server. Allowing only LAN users to access your development server prevents a search engine or hacker from getting to your website:

<limit GET POST PUT>
order deny,allow
deny from all
allow from 192.168.0.0/24
</limit>

Do you have any other reasons to ban IP addresses? Have any code to share? Please do!