Allow web access to a directory from one IP only

On a server compatible with Apache 2.4 rules, you can restrict web access to a folder with its .htaccess file. The rule does not by itself control FTP, SSH or local access to the files.

Prepare and add the rule

Confirm your public IP and keep a copy of the .htaccess outside the public root. Keep cPanel or SFTP available to revert the change if you lose web access.

In the .htaccess of the folder you want to restrict, a basic rule would be:

Require ip 192.0.2.25

Replace the documentation IP with the real authorised address. You can include more than one address in the same directive when needed; avoid allowing a whole CIDR range for a single connection.

A dynamic IP can change. If the service is behind a CDN or a proxy, confirm which one the server identifies as the source: allowing the intermediary may allow all its visitors.

If there is also a password

Review the existing set of rules before adding another. Several Require lines can behave as alternatives. If you need to require IP and a valid user, the block must express both conditions:

<RequireAll>
    Require ip 192.0.2.25
    Require valid-user
</RequireAll>

This second example assumes authentication is already set up with its users and password. It does not create the authentication mechanism by itself. Do not mix old Order/Allow/Deny rules with the modern ones without checking how they interact.

Check and revert if needed

Test from an allowed connection and from another of your own that is not allowed. Check the main folder and the direct paths it should cover, including subdirectories with their own rules.

If a 500 error appears, go back to the previous file and check the error log. If an allowed connection receives a 403, check the real IP and the combination of rules before opening access to everyone. An IP restriction complements the application's authentication; it does not turn an IP into an individual identity.