Tutorial - How do I block access to my website for certain IP addresses via a .htaccess file?

Objective

The aim of this tutorial is to help you secure access to your websites from external networks, and prevent intrusions and DoS attacks.

You can do this with a ".htaccess" file, a particular text file, that the web server (Apache) detects, and that allows you to define special rules for a directory and all of its subdirectories.

You can create multiple ".htaccess" files in the FTP space of your hosting but only one per directory or subdirectory to avoid conflicts between different .htaccess files.

Find out how to block access to your website for certain IP addresses via a ".htaccess" file.

Requirements

• An OVHcloud Web Hosting plan

Instructions

Block an IP, a range of IPs, a domain or all the IPs of a country

Several rules are available to block access to your hosting plan via ".htaccess".
Be careful with the syntax and block settings to prevent blocking yourself from viewing your hosted sites and/or scripts.
In the event of an error, you can always log in to the FTP space of your hosting to correct mistakes.

Block an IP

To block a specific IP address, insert one of the following two codes into your ".htaccess" file:

Deny from IP_address

<RequireAll>
Require all granted
Require not ip IP_address
</RequireAll>

• Example: If you want to block the IP address 203.0.113.0, you will need to write one of the following two codes:

Deny from 203.0.113.0

<RequireAll>
Require all granted
Require not ip 203.0.113.0
</RequireAll>

Block an IP range

To block an IP address range, insert one of the following two codes into your ".htaccess" file:

Deny from IP_range

<RequireAll>
Require all granted
Require not ip IP_range
</RequireAll>

• Example: If you want to block all IPs in 203.0.113.x, you will need to write one of the following two codes:

Deny from 203.0.113

<RequireAll>
Require all granted
Require not ip 203.0.113
</RequireAll>

Block a domain

Some domains might access your hosting via redirections or requests.

To block a domain, insert one of the following two codes into your ".htaccess" file:

Deny from domain

<RequireAll>
Require not host domain
</RequireAll>

• Example: if you want to block domain.tld, you will need to write one of the following two codes:

Deny from domain.tld

<RequireAll>
Require not host domain.tld
</RequireAll>

Block IPs from a country

To block all IPs of a country, insert one of the following two codes into your ".htaccess" file:

SetEnvIf GEOIP_COUNTRY_CODE Country_Code BlockCountry
Deny from env=BlockCountry

RewriteCond %{ENV:GEOIP_COUNTRY_CODE} ^(Country_Code)$
RewriteRule ^(.*)$ - [F,L]

• Example: If you want to block geolocated IP addresses from Fiji (FJ) and Greenland (GR), you will need to write one of the following two codes:

SetEnvIf GEOIP_COUNTRY_CODE FJ BlockCountry
SetEnvIf GEOIP_COUNTRY_CODE GR BlockCountry
Deny from env=BlockCountry

RewriteCond %{ENV:GEOIP_COUNTRY_CODE} ^(FJ|GR)$
RewriteRule ^(.*)$ - [F,L]

To authorise selected IPs, a range of IPs or all the IPs of a country

Rather than restricting access to one or more IPs and allowing others to access your hosting, you can do the opposite by blocking all IPs and then allowing only one or more IPs to access your service.

Authorise one or more IPs

To authorise only one IP to access your service, insert one of the following two codes into your ".htaccess" file:

order deny,allow
deny from all
Allow from IP_address

Require ip IP_address

• Example: If you only want to authorise IPs 203.0.113.0 and 203.0.113.1 to access your hosting, you will need to write one of the following two codes:

order deny,allow
deny from all
Allow from 203.0.113.0
Allow from 203.0.113.1

Require ip 203.0.113.0 203.0.113.1

Authorise an IP range

To authorise a range of IPs to access your service, insert one of the following two codes into your ".htaccess" file:

order deny,allow
deny from all
Allow from IP_range

Require ip IP_range

• Example: If you only want to authorise the IP range 203.0.113.x to access your hosting, you will need to write one of the following two codes:

order deny,allow
deny from all
Allow from 203.0.113

Require ip 203.0.113

Authorise all the IPs of a country

To authorise all IPs in a country to access your service, insert one of the following two codes into your ".htaccess" file:

order deny,allow
deny from all
SetEnvIf GEOIP_COUNTRY_CODE Country_Code AllowCountry
Allow from env=AllowCountry

RewriteCond %{ENV:GEOIP_COUNTRY_CODE} !^(Country_Code)$
RewriteRule ^(.*)$ - [F,L]

• Example: If you wish to authorise only Fiji (FJ) and Greenland (GR) to access your hosting, you will need to write one of the following two codes:

order deny,allow
deny from all
SetEnvIf GEOIP_COUNTRY_CODE FJ AllowCountry
SetEnvIf GEOIP_COUNTRY_CODE GR AllowCountry
Allow from env=AllowCountry

RewriteCond %{ENV:GEOIP_COUNTRY_CODE} !^(FJ|GR)$
RewriteRule ^(.*)$ - [F,L]

Further actions with the ".htaccess" file

Besides general access security to the hosting, the ".htaccess" file allows you to perform other actions. Below are more OVHcloud tutorials on the subject:

• Protect your website’s administration interface via ".htaccess".
• Rewrite your URLs using mod_rewrite
• Perform other operations with the ".htaccess" file

Go further

For specialised services (SEO, development, etc.), contact OVHcloud partners.

If you would like assistance using and configuring your OVHcloud solutions, please refer to our support offers.

Join our community of users.