My website isn't live yet and I want to be the only one who can access it. Up to this point, I just denied from all and allowed my ip. The problem is I'm not at home right now and I don't have an internet connection other than mobile. My guess is that my current ip from the mobile network is shared among many other people, so white listing this ip is something I'd not like to risk. Perhaps I could set a custom user agent that would act like a password? But then how would I configure apache to allow only from specific UA? Are there any other options?

Edit: Apache authentication works, but I have problem with making cross origin ajax requests. My web application requires to make ajax requests to my server. The application is distributed, not hosted so I allow all origins to my endpoint. Apache authentication somehow breaks it for me, "no access-control-allow-origin" header is present... origin localhost is therefore not allowed access.

Edit2: It doesn't work even with PayPal! Are there any better solutions?

Edit:3 I found a better solution. It works with my web app and visitors won't see a login form. Simply set a custom header to be sent with each request. I used Requestly Chrome extension for that (also allows to specify which urls should have custom headers sent). Then in vhost file:

SetEnvIf X-MY-TOKEN "secretmessage" AllowIp
Require all denied
Require ip some.ip
Require host paypal.com
Require env AllowIp

However PayPal IPN still won't work. I have also tried wrapping it in . I guess I have to whitelist my ip for a moment and see if it works.

Edit4: PayPal works now, they have some technical issues at sandbox.paypal.com

  • 2
    Best option here is to use Apache's built in authentication system. Setup example from Digital Ocean is here: digitalocean.com/community/tutorials/… – Tim Fletcher Sep 23 '16 at 8:08
  • Does it store user session? Like I won't have to type the password with every request? – Maciej Krawczyk Sep 23 '16 at 8:40
  • I also have to allow access to PayPal IPN addresses. – Maciej Krawczyk Sep 23 '16 at 8:42
  • What about VPN? – Broco Sep 23 '16 at 8:46
  • 1
    @MaciejKrawczyk yes in the way you have already used to block all IPs – Tim Fletcher Sep 23 '16 at 9:24

Assuming sshd is active on the server, use ssh port forwarding to accomplish this.

ssh userid@httpdserver -L{HTTPDPORT}:8080

  • HTTPDPORT is the local port on the web server

  • 8080 would be the local port on your development system you would use to access the webserver

To access the website you would go to, the httpd server will see you connection as coming from itself at it's localhost (

httpd will be blissfully happy because your connection appears "local".

If more ports are needed, add more port forwarding statements.

Note: It's also possible to route to other systems by changing the statement to



You could use authentication and allow by source for your known hosts:

AuthType Basic
AuthName "Restricted Content"
AuthUserFile /etc/apache2/.htpasswd

  Require ip
  Require valid-user
  • Though the principle is sound, that is a somewhat horrid combination of Apache v2.2 and v2.4 directives and is likely to cause unexpected issues, especially if used there are other global authorization directives. When using v2.4, best practise is to replace all v2.2 directives with the corresponding v2.4 ones and comment out the loading of mod_access_compat – Unbeliever Sep 23 '16 at 13:21

It depends on the level of security you need. I would rarely suggest security through obscurity, but if your main goal is to turn away accidental visitors you could simply move your application into a long randomly named sub-directory. As long as directory indexing is turned off, that's as good as an explicit password. Your app may not be comfortable running anywhere other than at the root though.

Another alternative it to add a catch-all sub-domain CNAME record to your DNS, then tell apache to listen only on some long randomly named sub-domain. As you are not explicitly naming the sub-directory in DNS, the only way to find it is either to know it, or brute force guess every possible sub directory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.