Restrict the Magento admin by IP

Limiting the Magento admin to known addresses reduces its exposure. Before changing rules, confirm the current admin path, make a copy of .htaccess and keep an alternative way in so you can revert the change.

This example only allows 203.0.113.10 on an admin path called admin:

RewriteEngine On
RewriteCond %{REQUEST_URI} ^/(index\.php/)?admin(?:/|$) [NC]
RewriteCond %{REMOTE_ADDR} !^203\.0\.113\.10$
RewriteRule ^ - [F,L]

Replace the IP with your exact public address, escaping the dots and keeping ^ and $. To allow several IPs, add an exact negative condition for each one:

RewriteEngine On
RewriteCond %{REQUEST_URI} ^/(index\.php/)?admin(?:/|$) [NC]
RewriteCond %{REMOTE_ADDR} !^203\.0\.113\.10$
RewriteCond %{REMOTE_ADDR} !^203\.0\.113\.12$
RewriteRule ^ - [F,L]

If you use a different path, replace admin with its exact value. Do not shorten the expression to accommodate a dynamic IP: you could authorise a much wider range than intended. In that case, use a VPN with a fixed exit IP or another managed control.

If Magento is behind Cloudflare, a load balancer or another proxy, first confirm that Apache receives the visitor's real IP in REMOTE_ADDR; otherwise you could authorise or block the proxy's IP. Test from an allowed connection and a denied one.

This restriction complements, but does not replace, a custom admin path, unique passwords, 2FA, CAPTCHA, login attempt limiting and Magento updates.

Adjust the path and check the result

The example assumes the shop lives at the root of the domain. If it is in /tienda, the condition must include that prefix; if there are several hostnames or entry paths, check them all. In Magento 2 you can check the configured path with bin/magento info:adminuri from the installation, as described in Adobe's documentation.

Place the restriction before the general rules that send requests to Magento's front controller. Test both the friendly path and its index.php variant, from an authorised IP and an unauthorised one. A 500 error indicates a configuration problem, not a working restriction.

The rule covers that admin path, not every API or integration of the shop. If the server does not use .htaccess, the control must be configured in the equivalent layer. Keep access to the hosting so you can restore the previous file if you lock yourself out.