Protecting your site
BOA's built-in access protections and the locks you add yourself: opting out of a built-in guard per site, whole-site and login/admin IP allow-lists, and the per-site AI crawler policy.
Your sites come protected out of the box: BOA switches on a set of access protections for every site, and your host keeps them current. This topic covers the handful of decisions that are yours — opting out of a built-in guard when it's genuinely in your way, locking things down further with your own IP allow-lists, and deciding which AI bots may read each site.
- Restricting access to your site — the protections
BOA turns on for you (the
/admin*page protection among them), what each one does, and how to opt out of one per site when you need to. - Site IP lock — make a whole site reachable only from IP addresses you list: intranets, staging copies, admin-only tools.
- Login/admin IP lock — keep a site public
while its
/userand/adminpages answer only to your own addresses. - AI crawlers — which classes of AI bot may read each of your sites: training crawlers are blocked for you by default, AI search and assistant fetchers are allowed, and one control file changes it per site.
Everything here happens in your own world — a small control file in your account or a line in an INI file, never root and never the server. Which of your files to edit, and why a change takes about a minute to show up, is explained in Which file do I edit?; the per-line reference for the access-control settings is on INI settings.
Restricting access to your site
The access controls you manage from your own files — the default admin-page protection explained in full, with pointers to the site IP lock, the login/admin IP lock, and the AI crawler policy, each on its own page.
Locking a whole site to your own IP addresses
Make an entire site reachable only from IP addresses you list — ideal for intranets, staging copies and admin-only tools — from one control file in your own account, with built-in protection against locking yourself out.
Locking the login and admin area to your own IP addresses
Keep a site public while its /user and /admin pages answer only to IP addresses you list — one control file in your own account, with built-in protection against locking yourself out.
AI crawlers and assistants on your sites
Which AI bots may read your sites: training crawlers are blocked by default, AI search and assistant fetchers are allowed and rate-limited, and one control file changes it per site.