Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an admin directory on my web server ( and I don't want unauthorized parties to access this /admin/ directory instead I want to return 404 error code for all unauthorized accesses.

My question is, is there any way to return 404 error code for all access attempts except a few specific IP addresses?

My web server is Apache on Linux (plesk).

share|improve this question
Presumably you're choosing to deliberately hide the resource rather than return a 403? – annakata May 27 '09 at 15:20
+1 for ironic username. – TheTXI May 27 '09 at 15:21
up vote 4 down vote accepted

Well, close:

<Location /admin>
     Order deny,allow
     Allow from
     Allow from
     Deny from all

Though what this actually does is return a 403 Forbidden, not a 404 Not Found, which is, y'know, correct.

If you're putting this in a .htaccess in the admin directory, you don't need the Location container. The example is written for a server or virtual host configuration file.

See also mod_access docs.

For what it's worth, as time has worn on I've increasingly come to find value in putting the site admin on an entirely separate virtual host.

share|improve this answer

You can use mod_rewrite to do that.

RewriteEngine on
RewriteCond %{REMOTE_ADDR} != [OR]
RewriteCond %{REMOTE_ADDR} !=
RewriteRule ^admin($|/) - [L,R=404]

Note that the R=404 flag requires at least Apache 2.1.1.

share|improve this answer
This is brilliant for properly hiding .htaccess, etc., not to mention WEB-INF when fronting for a servlet container and keeping everything in the same source directory. Cheers! – T.J. Crowder Oct 13 '09 at 11:27

check the "allow from" attribute in the configuration guide

share|improve this answer

Under litespeed the following small variation with mod_rewrite worked for me:

RewriteEngine on
RewriteCond %{REMOTE_ADDR} !^ [OR]
RewriteCond %{REMOTE_ADDR} !^
RewriteRule (.*) - [R=404,L]
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.