Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For testing on my pre-live site, I'd like to allow only my own IPs and PayPal Sandbox.

For production, I'd like to allow only PayPal to my IPN listener.

I can restrict in .htaccess to my IPs, but including causes 403 in the IPN generator on the SandBox.

I understand this may be a security issue for PayPal, but I'd like it anyway if possible.

share|improve this question
up vote 0 down vote accepted

If you are testing with paypal sandbox, your .htaccess allow should look like follow

    Allow from

That should allow incomming connection from all machine with * RDNS.

You maybe missing the "dot" before paypal.

If using LiteSpeed web server try following

    Allow from

That is IP for Also check your server log and see what IPs are being reject.

share|improve this answer
Thank-you for you help. I tried and sandbox IPN still gives 403. Is that in LiteSpeed format? – user144330 Nov 8 '12 at 2:12
Lightspeed don't seems to support hostname in htaccess allow. I updated my answer. – John Siu Nov 8 '12 at 2:32
That worked (but Allow should be allow). That address works for sandbox, but it won't work for production because PayPal is using dynamic IPs. If it's truly true that litespeed won't allow domains, that add to their crappines. Know anything about this?… – user144330 Nov 8 '12 at 2:55
Paypal is not using dynamic IPs, but they have multiple server for the same hostname. You can get the list at (That link is from… Section 5) – John Siu Nov 8 '12 at 3:08
OK, phew. I must've misread. I thought they were applying it to the IPN deliverer. – user144330 Nov 8 '12 at 3:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.