In wordpress, I have been disabling unknown people from accessing my wp-login.php using a script in the .htaccess.

RewriteCond %{REMOTE_ADDR} !^154\.70\.159\.2
RewriteRule ^wp-(login|register)\.php http://www.example.com [R,L]
RewriteRule ^wp-(admin)\.php http://www.example.com [R,L]

Meaning only the user with that above IP will b allowed to Login.

How can I do this with Drupal, so that I redirect unknown user with different IP to my homepage. Those who try to visit the www.example.com/user link.

2 Answers 2


There is the restrict by IP module, which can solve the use-case pretty fast. For the second part, depending on if you are in 7 or 8, you would want to write code to handle a request to either of the routes, evaluate the allowed IPs against the user IP, and do a redirect. Would be easier and more manageable vs the htaccess route, in my opinion.

You can disable user registration by disabling it in the admin (only admins can create accounts).

Furthermore, no one can even get to /admin or administrative pages without the right permissions anyway, so if they are not logged in, it isn't really an issue. That just leaves the login and forgot password page. Forcing a redirect within admin paths might also interfere with things like AJAX actions as well - I would probably leave that alone.


You can use roughly the same rewrite rules in your .htaccess:

RewriteCond %{REMOTE_ADDR} !^154\.70\.159\.2
RewriteRule ^user/ http://www.example.com [R,L] // Prevent access to any user/* URL
RewriteRule ^admin/ http://www.example.com [R,L] // Prevent access to any /admin/*

The second rule should prevent access to most admin page, but some admin pages/features are no behind such URLs and cannot be easily protected this way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.