I want to restrict the http://www.mysite.com/admin login page to a particular IP only. Do you have any suggestion?

  • Would this question be of any help to you? drupal.stackexchange.com/questions/58898/… – frazras Jul 28 '13 at 6:56
  • im not sure, check the login security module – Bala Jul 28 '13 at 12:18
  • There isn't a login form at /admin; you'd get a 403 unless there's a module interfering (maybe r4032login or similar). So you'll need to alter the output of whatever that module is to get the effect you're looking for. Could you update the question with that information? – Clive Jul 28 '13 at 15:37
  • The login page is at /user/login (Though /user display this page if you are not logged in). Have you tried blocking that path as well? – Neograph734 Jul 24 '17 at 14:41
  • "I tried using the Restrict IP module to block the /user and ?q=user routes but this did not work." - did you try debugging why? Is the site behind a load-balancer? Are you forwarding IPs to Drupal correctly? – Joseph Jul 24 '17 at 14:53

I think I would go for doing this at the Apache level before hitting Drupal.

Have a look at the Apache manual for doing this but you are looking at something like this:

# Only allow request for admin only from localhost.
<Location /admin>
  Deny from all
  Allow from

So admin will be denied for all but allowed from for example. Also take in to account cleanurls. You will need to deny access to ?q=admin aswell.


There are a lot of IP modules out there that block access to the website by IP, but these are black/whitelists for the whole website.

There is a module called Restrict IP which only allows whitelisted IPs to log in.

In general, this module provides features that allow an IP address (or range of IP addresses) to be whitelisted which restrict the functionality of users. Currently there are two features implemented:

Restrict login by IP

When a user is restricted, that user will not be able to log in outside the defined IP address ranges. It is also possible to specify global IP address ranges, which apply to ALL users, including user1. Following a denied log-in attempt, a user is redirected to an error page as specified by the site administrator.

Restrict role by IP

When a role is restricted, that role will not be available to users outside the defined IP address ranges. Role restriction does not affect users' ability to log in, only the availability of the restricted role to users. Role restrictions are available for all roles, except "anonymous user" and "authenticated user".

  • "Restrict role by IP" modules seems not to work anymore! – Tapash Jul 30 '19 at 18:33

Have a look at the following function, it may help you:

function yourmodule_menu_alter($items) {
  $items['admin']['access callback'] = 'yourmodule_check_by_ip';

function yourmodule_check_by_ip() {
  switch ($_SERVER['REMOTE_ADDR']) {
      return false;
      return false;
      return TRUE;
  • 1
    I formatted your code for you. Hint: no need to repeat return false; - you may simply write several cases right one after another. And there is no need for break after return - it's an unreachable code anyway. – Mołot Aug 7 '14 at 13:50

This can be done by configuring .htaccess to raise the [F] flag (returns a 403 Forbidden status code to the client) for certain URLs when %{REMOTE_ADDR} doesn't match a given IP.

To be placed after RewriteEngine on:

RewriteCond %{REMOTE_ADDR} !^100\.22\.44\.[8-9]$
RewriteRule ^/user - [F]
RewriteRule ^/USER - [F]

There is a module available for D7 to provide page level access for IPs

Restrict Page IP

Provides administrator to restrict/allow access to pages based on user IPs.


  • IPs can be an individual IP or range of Ips.
  • Page url can have wild cards like 'blog/*'
  • Restricted user IPs will be denied showing custom error message (can be modified on module's configuration page)

Note : User 1 has been skipped from these restrictions.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.